Support start api with tls

[softprops]

Describe your idea/feature/enhancement

Provide a clear description. Ex. I wish SAM CLI would [...]

I wish sam local start-api would support https.

Proposal

Add details of how to add this to the product.

The start-api subcommand starts up a Flask app to simulate api gateway generated events. Most clients of api gateway expect an https interface. Flask supports an ssl_context.

Allow users to provide a self signed key and cert to opt into an https supported mode of start-api. Omitting these would have the same effect as we have today, a non tls interface.

Things to consider:

1. Will this require any updates to the SAM Spec

No.

Additional Details

[ssenchenko]

sam local start-api created for local testing and for exposing API to external connections. What specific use case do you have in mind that is hindered by sam local start-api not supporting HTTPS?

[kodmunki]

@ssenchenko we need this for local development as well. Does this project not support HTTPS? Looking through the source and it appears that is the case. Someone please share if this is not the case and the sam local start-api does, in fact, support HTTPS.

To your question @ssenchenko we need it because we cannot run our project locally in development. The project front-end requires HTTPS to support front-end persistence and it causes browsers to throw Mixed Content errors and will not serve the SAM Local backend payloads over HTTP.

Could someone share if/when this project would support HTTPS?

[ssenchenko]

Can you relax your FE requirements for running locally? Locally you don't actually need HTTPS.

If you want to run integration or end-to-end tests the way to do it is deploying to the test/staging environment at cloud. It's the only way to ensure that your integration/end-to-end testing is as close to your prod as your configuration of the environment is close to prod.

The nature of local environment is different from the cloud. We are working on making them as close as possible but it takes time. And some differences cannot be eliminated at this point of time anyway.

We have a roadmap here, but we also try to take in popular feature requests based on 👍🏽 from the community. This feature doesn't seem to be getting many votes so far. At least not yet.

[samaybhavsar]

Hi,

I encountered similar issue during development. We are using secure cookies for authentication and this requires the endpoints to be HTTPS.

Here is the work around on how we set this up:-

https://gist.github.com/samaybhavsar/b2fc549094bdc1e36eb25826db75a080

[jeremymturner]

+1 on this feature. I have the same use case, I use code that requires HTTPS in order for a user to authenticate with an external server, and it fails if the local content and API are HTTP.