DEV Community

Cover image for A crash course on securing Serverless APIs with JSON web tokens

A crash course on securing Serverless APIs with JSON web tokens

Adnan Rahić on May 03, 2018

What a mouthful of a title. Wouldn’t you agree? In this walkthrough you’ll learn about securing your Serverless endpoints with JSON web tokens. Th...
Read full post
Collapse
 
hafizurcse profile image
hafizurcse •

Hey, I have installed npm install --save-dev serverless-offline and I am getting the following when I try offline:

hafizur@hafizur-MacBookPro:~/aws-proj/express-sls-app$ sls offline start --skipCacheInvalidation

  Serverless Error ---------------------------------------

  Serverless command "offline" not found. Did you mean "config"? Run "serverless help" for a list of all available commands.

  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com

  Your Environment Information ---------------------------
     OS:                     linux
     Node Version:           8.10.0
     Serverless Version:     1.40.0
Enter fullscreen mode Exit fullscreen mode
Collapse
 
mkotsollaris profile image
Menelaos Kotsollaris •

you have to make sure that you are properly authenticated to aws.

docs.aws.amazon.com/cli/latest/use...

Collapse
 
er_raoniz profile image
Rahul Soni • • Edited

Please revert if you found a solution. I, too, am experiencing this issue. Also, I have checked the credentials, they are properly configured.

Collapse
 
fernandotbarros profile image
Fernando Teixeira Barros •

I like the way this middleware auth functions works, but I don't know how to make this function redirect to some login page when the user is not allowed to access some route. I don't know if I'm making confuse here, but I didn't find it anywhere!

Collapse
 
adnanrahic profile image
Adnan Rahić •

The examples only show the API. You need to set up the authorizer function to respond with unauthorized and a proper status code like 401 if the user is not authorized to access a resource. This is what you catch on the front end, and handle redirects to a login page.