Our new API gateway lowercased every header and no partner could place an order
At nine on a Monday in March, every one of our trade partners' systems started getting 400 Bad Request from our order intake API, with the body missing partner id. Over the weekend we had moved the API from an Amazon API Gateway REST API to an HTTP API, which costs less and suited what the API does. Partners identify themselves with an X-Partner-Id header. Our Lambda read it with…
On a Monday in March, trade partners began experiencing issues with our order intake API. The problem arose after we switched the API from Amazon API Gateway REST to an HTTP API. Our Lambda function read the X-Partner-Id header to identify partners, but with the new HTTP API, header names were lowercased. Our code expected the header name to be in the original capitalization, treating all partners as anonymous.
The issue persisted because our tests assumed the header name would be capitalized. Upon rolling back the DNS, orders resumed flowing shortly after. To prevent future issues, we now normalize header names to lowercase at the edge of the API gateway and ensure tests are captured from the real gateway in staging, not written manually.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
