You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The repository also includes helper scripts in `/test-scripts` that exercise token validation, token binding, message signing, and Structured Field parsing against the protected server.
18
18
19
19
## Setup Environment
20
20
21
-
Do not forget to properly setup the `.env` file in the root of each Approov protected server example before you run the server with the docker stack.
21
+
Do not forget to properly setup the `.env` file in the root of the Approov protected server example before you run the server with the docker stack.
Edit each file and add the [dummy secret](/TESTING.md#the-dummy-secret) to it in order to be able to test the Approov integration with the provided [Postman collection](https://github.com/approov/postman-collections/blob/master/quickstarts/hello-world/hello-world.postman_curl_requests_examples.md).
27
+
Edit the file and add the [dummy secret](/TESTING.md#the-dummy-secret) to it in order to be able to test the Approov integration with the provided [Postman collection](https://github.com/approov/postman-collections/blob/master/quickstarts/hello-world/hello-world.postman_curl_requests_examples.md). Set `APPROOV_TOKEN_BINDING_HEADER` (for example `Authorization`) and tweak the optional `APPROOV_SIGNATURE_*` variables to explore token binding and message signing policies.
29
28
30
29
31
30
## Docker Stack
32
31
33
32
The docker stack provided via the `docker-compose.yml` file in this folder is used for development proposes and if you are familiar with docker then feel free to also use it to follow along the examples on the README of each server.
34
33
35
-
If you decide to use the docker stack then you need to bear in mind that the Postman collections, used to test the servers examples, will connect to port `8002` therefore you cannot start all docker compose services at once, for example with `docker-compose up`, instead you need to run one at a time as exemplified below.
34
+
If you decide to use the docker stack then you need to bear in mind that the Postman collections, used to test the servers examples, will connect to port `8111` therefore you cannot start all docker compose services at once, for example with `docker-compose up`, instead you need to run one at a time as exemplified below.
36
35
37
36
### Build the Docker Stack
38
37
39
-
The three services in the `docker-compose.yml` use the same Dockerfile, therefore to build the Docker image we just need to used one of them:
38
+
The services in the `docker-compose.yml` use the same Dockerfile, therefore to build the Docker image we just need to use one of them:
Now, you are ready to start using the Docker stack for ASP.Net.
@@ -76,20 +75,6 @@ or get a bash shell inside the container:
76
75
sudo docker-compose run --rm --service-ports approov-token-check zsh
77
76
```
78
77
79
-
#### For the Approov Token Binding Check
80
-
81
-
Run the container attached to the shell:
82
-
83
-
```bash
84
-
sudo docker-compose up approov-token-binding-check
85
-
```
86
-
87
-
or get a bash shell inside the container:
88
-
89
-
```bash
90
-
sudo docker-compose run --rm --service-ports approov-token-binding-check zsh
91
-
```
92
-
93
78
## Issues
94
79
95
80
If you find any issue while following our instructions then just report it [here](https://github.com/approov/quickstart-asp.net-token-check/issues), with the steps to reproduce it, and we will sort it out and/or guide you to the correct path.
@@ -99,7 +84,7 @@ If you find any issue while following our instructions then just report it [here
99
84
100
85
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
Copy file name to clipboardExpand all lines: OVERVIEW.md
+5-3Lines changed: 5 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,8 +33,10 @@ The backend server ensures that the token supplied in the `Approov-Token` header
33
33
34
34
The request is handled such that:
35
35
36
-
* If the Approov Token is valid, the request is allowed to be processed by the API endpoint
37
-
* If the Approov Token is invalid, an HTTP 401 Unauthorized response is returned
36
+
* If the Approov Token is valid, the request is allowed to be processed by the API endpoint.
37
+
* If the Approov Token is invalid, an HTTP 401 Unauthorized response is returned.
38
+
* Optional [token binding](https://approov.io/docs/latest/approov-usage-documentation/#token-binding) recomputes the binding hash from headers such as `Authorization` and must match the token’s `pay` claim before the request is processed.
39
+
* Optional [message signing](https://approov.io/docs/latest/approov-usage-documentation/#message-signing) reconstructs the canonical HTTP message and validates the signature supplied in the `Signature` / `Signature-Input` headers using the installation public key embedded in the token.
38
40
39
41
You can choose to log JWT verification failures, but we left it out on purpose so that you can have the choice of how you prefer to do it and decide the right amount of information you want to log.
40
42
@@ -43,7 +45,7 @@ You can choose to log JWT verification failures, but we left it out on purpose s
43
45
44
46
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
[Approov](https://approov.io)is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps.
3
+
[Approov](https://approov.io)ensures that API traffic reaching your backend originates from trusted versions of your mobile apps. This repository collects the server-side quickstarts for ASP.NET 8 and reuses a single reference implementation at `servers/hello/src/approov-protected-server/token-check`.
4
4
5
5
6
6
## The Quickstarts
7
7
8
-
The quickstart code for the Approov backend server is split into two implementations. The first gets you up and running with basic token checking. The second uses a more advanced Approov feature, _token binding_. Token binding may be used to link the Approov token with other properties of the request, such as user authentication (more details can be found [here](https://approov.io/docs/latest/approov-usage-documentation/#token-binding)).
0 commit comments