The client of an API can use any values to formulate a URL, but it cannot tamper with the content of the JWT token because the issuer has signed the token. Therefore, we need to override any request values with the values from the token. In this recipe, we are saving and retrieving data for a specific user as determined by the subject or subclaim in the user's token. The service is configured with an authorizer that verifies the token and forwards claims.
To simplify the example, the subject is used as the HASH key and the data uuid as the RANGE key. When the data is retrieved, we assert the query parameter against the value in the token and return a 401 statusCode if they do not match. If they match, we use the value from ...
