Requesting a similar capability provided by AWS API Gateway Lambda authorizers (https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html) for GCP API Gateway. In short, provide the ability to support customize authorization at the API Gateway level via Cloud Function (or other). This would allow teams to use all of the powerful features of API Gateway without having to modify their current auth implementation if it’s not using JWT (e.g. opaque session token sent via cookie).

How this might work:

Developer creates a custom Cloud Function with the sole purpose of handling authorization (perhaps it expects a request as input and outputs a policy)
Developer attaches the Cloud Function to the API Gateway and provides all necessary configuration details
API Gateway intercepts a request, identifies that a custom authorizer has been attached and forwards the request
Custom authorizer executes and decides whether to permit/deny the request and returns the appropriate policy. Note: This function could enable any type of authorization (e.g. JWT integration with Auth0, opaque session token stored in Memorystore / Datastore / etc.).

If applicable, reasons why alternative solutions are not sufficient:

Teams that want to integrate API Gateway into their system architecture and use it to perform authorization are forced to do one of two things if they have an existing authorization system at their application level:
1. Redesign their authorization system to conform to the limitations of API Gateway
2. Use a subset of features provided by API Gateway but keep authorization at the application level

Other information (workarounds you have tried, documentation consulted, etc):

https://cloud.google.com/api-gateway/docs/authentication-method

Issue 226426383

Links (2)

Issue metadata