Serverless GitHub OAuth for Sveltia CMS
A stateless AWS Lambda that self-hosts the GitHub OAuth handshake for a git-based CMS — no third-party auth service, secrets in SSM.
awslambdaoauthsecurity
Git-based CMSs like Sveltia need a small server-side component to complete the GitHub OAuth handshake — the token exchange requires a client secret that can never ship to the browser. Most guides point you at a third-party auth relay; I wanted to own that path.
Design
A single AWS Lambda behind a Function URL — no API Gateway, no servers, no state. It implements both halves of the OAuth dance:
/authredirects the editor to GitHub’s authorize page./callbackexchanges the returned code for an access token and hands it back to the CMS window viapostMessage.
The GitHub OAuth app’s client ID and secret live in an SSM SecureString parameter, read at cold start — they’re not in Terraform state, not in the repo, and not in Lambda environment variables visible in the console.
Why it’s nice
- Free at this scale — the Lambda runs for a few hundred milliseconds per CMS login; the Function URL costs nothing to keep around.
- No trust delegation — an auth relay run by someone else sees your OAuth tokens in transit. This one is mine, auditable in a couple hundred lines.
- Fully Terraform-managed — the Lambda, its role, the Function URL, and the SSM wiring deploy with the rest of the site’s infrastructure.