aws4-express

import express from 'express'; import { awsVerify, rawBodyFromVerify } from 'aws4-express'; import aws4 from 'aws4'; import https from 'https'; const app = express(); // 1. Important: We need the raw body to check the signature! // Must configure Express body parsers to provide rawBody. app.use(express.json({ verify: rawBodyFromVerify })); // 2. Add the AWS SigV4 security middleware app.use(awsVerify({ secretKey: (message) => { // 3. Implement your logic to find the secret for the incoming Access Key // In a real application, this would involve a database lookup. if (message.accessKey === 'MY_COOL_KEY') { return 'MY_SUPER_SECRET'; } return undefined; // Unknown key? Access denied! } })); // 4. This route is protected by AWS SigV4 verification app.get('/secret-club', (req, res) => { res.send('Welcome to the VIP area! 🎉 If you see this, your signature was valid.'); }); const PORT = 3000; app.listen(PORT, () => { console.log(`Server listening on http://localhost:${PORT}`); console.log('--- Client Test ---'); // Example client-side usage with aws4 library const opts = aws4.sign({ service: 'execute-api', path: '/secret-club', method: 'GET', host: `localhost:${PORT}`, headers: { 'Content-Type': 'application/json' } }, { accessKeyId: 'MY_COOL_KEY', secretAccessKey: 'MY_SUPER_SECRET' }); // Send the signed request const clientReq = https.request(opts, res => { console.log(`Client received status: ${res.statusCode}`); res.pipe(process.stdout); }); clientReq.on('error', (e) => console.error(`Client request error: ${e.message}`)); clientReq.end(); });