title: AWS API Gateway with Cognito Authorization never blocks requests even with invalid id tokens
body: <p>I followed <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.html" rel="nofollow noreferrer">this AWS API Gateway doc</a> and set up an authorization for my API with a <code>cognito identity token</code>. I tested my cognito id token in the <code>API Gateway</code> console, that works: It gives me the correct values, the sub and email values are correctly retrievd from the token:</p>
  <p><a href="https://i.stack.imgur.com/AvncL.png" rel="nofollow noreferrer">testing the id token works</a></p>
  <p>I then added the Authorizor to my Method:</p>
  <p><a href="https://i.stack.imgur.com/Zw3FJ.png" rel="nofollow noreferrer">my method request</a></p>
  <p>But when I now test my method, still all requests go through (with or without identity token provided) when I send them from the test form in API Gateway (inside the method):</p>
  <p><a href="https://i.stack.imgur.com/e7BS8.png" rel="nofollow noreferrer">teting with no token or invalid token</a></p>
  <p>I would have expected an &quot;Unauthorized&quot; or &quot;Access Denied&quot; response, instead I get 200.
  I also tried setting &quot;API Key Required&quot; in Method Request to true and require an Autorization Header, but even then the request from above comes through with status 200:</p>
  <p><a href="https://i.stack.imgur.com/5or7L.png" rel="nofollow noreferrer">setting API Key Required to true</a></p>
  <p>I also added</p>
  <pre><code>&quot;context&quot; : {
          &quot;sub&quot; : &quot;$context.authorizer.claims.sub&quot;,
          &quot;email&quot; : &quot;$context.authorizer.claims.email&quot;
  }
  </code></pre>
  <p>to my mapping template, so the full template now looks like this:</p>
  <pre><code>{
      &quot;TableName&quot;: &quot;myUsersTable&quot;,
      &quot;Key&quot;: {
          &quot;id&quot;: {&quot;S&quot;: &quot;$input.params('id')&quot;},
          &quot;username&quot;: {&quot;S&quot;: &quot;$input.params('id')&quot;}
      },
      
      &quot;context&quot; : {
          &quot;sub&quot; : &quot;$context.authorizer.claims.sub&quot;,
          &quot;email&quot; : &quot;$context.authorizer.claims.email&quot;
      }
  }
  </code></pre>
  <p>but the log is always empty for sub and email (and the response status is still 200):</p>
  <pre><code>Tue Dec 29 10:35:46 UTC 2020 : Endpoint request body after transformations: {
      &quot;TableName&quot;: &quot;myUsersTable&quot;,
      &quot;Key&quot;: {
          &quot;id&quot;: {&quot;S&quot;: &quot;testUser&quot;},
          &quot;username&quot;: {&quot;S&quot;: &quot;testUser&quot;}
      },
      
      &quot;context&quot; : {
          &quot;sub&quot; : &quot;&quot;,
          &quot;email&quot; : &quot;&quot;
      }
  }
  </code></pre>
  <p>What am I doing wrong here?</p>