I need to create an endpoint that returns different data based on the user’s role. If the role is not present (or the access token is missing), it should return only public data.

Examples

With Access Token:

HTTP GET https://example.com/users

[
  {
    "id": 1,
    "name": "John",
    "privateField": "Private data"
  },
  {
    "id": 2,
    "name": "Jame",
    "privateField": "Private data"
  }
]

Without Access Token:

HTTP GET https://example.com/users

[
  {
    "id": 1,
    "name": "John"
  },
  {
    "id": 2,
    "name": "Jame"
  }
]

Existing code base

I have a working HttpLambdaAuthorizer configured as follows in my AWS CDK:

const authorizer = new HttpLambdaAuthorizer("Authorizer", lambda, {
  responseTypes: [HttpLambdaResponseType.SIMPLE],
  resultsCacheTtl: Duration.minutes(5),
  identitySource: ["$request.header.cookie"]
});

The issue is that if AWS can’t find any value inside the $request.header.cookie path, it returns 403 Forbidden without calling the attached Lambda. If I try to add an empty string like this:

// cut
identitySource: ["$request.header.cookie", ""], 
// cut

I get the following error:

Invalid identity source expression: . The source must be a request header, request querystring, stage variable or context parameter.

I am using APIGatewayV2 (HttpApi) and AWS CDK.

Is it possible to achieve this using HttpLambdaAuthorizer? If so, how can I configure it to handle requests both with and without an access token?

Thank you!