Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
angular-aws-apig
Advanced tools
Angular interceptor for $http service that signs all requests to AWS APIGateway with IAM credentials.
This library provides an Interceptor for angular $http
service that signs all request to AWS APIGateway with IAM credentials. It is handy when you use temprorary IAM Credentials from AWS Cognito
or Auth0
. Although AWS APIGateway provides autogenerated Javascript SDK, you can't use it with angular $http
service and you need to regenerate it every time you change something in the API.
You have several options:
bower install angular-aws-apig --save
npm install angular-aws-apig --save
Or just include dist/angular-aws-apig.js
or dist/angular-aws-apig.min.js
in to your index.html
angular.module('app', ['angular-aws-apig'])
.config(function Config($httpProvider, APIGInterceptorProvider) {
APIGInterceptorProvider.config({
headers: {},
region: 'us-east-1',
service: 'execute-api',
urlRegex: ''
})
/* @ngInject */
APIGInterceptorProvider.headersGetter = function(myService, request) {
myService.doSomething();
return request.headers;
};
/* @ngInject */
APIGInterceptorProvider.credentialsGetter = function(store, request) {
return store.get('credentials');
};
$httpProvider.interceptors.push('APIGInterceptor');
});
headers
- global headers that would be added to all api requests (default: {}
)region
- AWS region (default: us-east-1
)service
- AWS service (default: execute-api
)urlRegex
- RegEx string, Interceptor would ignore requests to url that doesn't match this RegEx. (default: ''
)All options could be passed in APIGInterceptorProvider.config
function as a single object or assigned directly
APIGInterceptorProvider.urlRegex = 'myapi.com';
A function that provides dynamic headers. It accepts $http request
object as a parameter and must return headers
object. You can pass angular dependencies in this function.
APIGInterceptorProvider.headersGetter = function($rootScope, request) {
var headers = request.headers
headers.foo = $rootScope.foo;
return headers;
};
A function that provides dynamic AWS IAM Credentials. It accepts $http request
object as a parameter and must return credentials
object. You can pass angular dependencies in this function. Function can return $q
promise.
If this function is not specified APIGInterceptor
will try to get credentials from AWS.config.credentials
APIGInterceptorProvider.credentialsGetter = function(awsCredentials, auth) {
return awsCredentials.get(auth.idToken);
};
In this example awsCredentials.get
returns a promise that resolves with credentials
object
{
accessKeyId: 'accessKeyId',
secretAccessKey: 'secretAccessKey',
sessionToken: 'sessionToken'
}
This event would be triggered on request error.
$rootScope.$on('$APIGError', (event, error) => {
$log.debug(event, error);
});
This library is a wrapper around aws4 npm package.
FAQs
Angular interceptor for $http service that signs all requests to AWS APIGateway with IAM credentials.
We found that angular-aws-apig demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.