Skip to content

Commit e8485de

Browse files
Exadra37Exadra37
committed
The repo uses now the new simpler format for the quickstarts and examples. Updated the NodeJS depedencies on all Hello servers and in the Shapes server.
1 parent 53862df commit e8485de

17 files changed

+1545
-819
lines changed

‎servers/hello/Dockerfile renamed to ‎Dockerfile

File renamed without changes.

‎EXAMPLES.md

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
# Approov Integrations Examples
2+
3+
[Approov](https://approov.io) is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps, and here you can find the Hello servers examples that are the base for the Approov [quickstarts](/docs) for NodeJS.
4+
5+
For more information about how Approov works and why you should use it you can read the [Approov Overview](/OVERVIEW.md) at the root of this repo.
6+
7+
If you are looking for the Approov quickstarts to integrate Approov in your NodeJS API server then you can find them [here](/QUICKSTARTS.md).
8+
9+
10+
## Hello Server Examples
11+
12+
To learn more about each Hello server example you need to read the README for each one at:
13+
14+
* [Unprotected Server](./servers/hello/src/unprotected-server)
15+
* [Approov Protected Server - Token Check](./servers/hello/src/approov-protected-server/token-check)
16+
* [Approov Protected Server - Token Binding Check](./servers/hello/src/approov-protected-server/token-binding-check)
17+
18+
19+
## Docker Stack
20+
21+
The docker stack provided via the `docker-compose.yml` file in this folder is used for development proposes and if you are familiar with docker then feel free to also use it to follow along the examples on the README of each server.
22+
23+
If you decide to use the docker stack then you need to bear in mind that the Postman collections, used to test the servers examples, will connect to port `8002` therefore you cannot start all docker compose services at once, for example with `docker-compose up`, instead you need to run one at a time as exemplified below.
24+
25+
### Setup Env File
26+
27+
Do not forget to properly setup the `.env` file in the root of each Approov protected server example before you run the server with the docker stack.
28+
29+
```bash
30+
cp ./servers/hello/src/approov-protected-server/token-check/.env.example ./servers/hello/src/approov-protected-server/token-check/.env
31+
cp ./servers/hello/src/approov-protected-server/token-binding-check/.env.example ./servers/hello/src/approov-protected-server/token-binding-check/.env
32+
```
33+
34+
Edit each file and add the [dummy secret](/TESTING.md#the-dummy-secret) to it in order to be able to test the Approov integration with the provided [Postman collection](https://github.com/approov/postman-collections/blob/master/quickstarts/hello-world/hello-world.postman_curl_requests_examples.md).
35+
36+
37+
### Build the Docker Stack
38+
39+
The three services in the `docker-compose.yml` use the same Dockerfile, therefore to build the Docker image we just need to used one of them:
40+
41+
```bash
42+
sudo docker-compose build approov-token-binding-check
43+
```
44+
45+
Now, you are ready to start using the Docker stack for NodeJS.
46+
47+
48+
### Command Examples
49+
50+
To run each of the Hello servers with docker compose you just need to follow the respective example below.
51+
52+
#### For the unprotected server
53+
54+
Run the container attached to your machine bash shell:
55+
56+
```bash
57+
sudo docker-compose up unprotected-server
58+
```
59+
60+
or get a bash shell inside the container:
61+
62+
```bash
63+
sudo docker-compose run --rm --service-ports unprotected-server zsh
64+
```
65+
66+
#### For the Approov Token Check
67+
68+
Run the container attached to the shell:
69+
70+
```bash
71+
sudo docker-compose up approov-token-check
72+
```
73+
74+
or get a bash shell inside the container:
75+
76+
```bash
77+
sudo docker-compose run --rm --service-ports approov-token-check zsh
78+
```
79+
80+
#### For the Approov Token Binding Check
81+
82+
Run the container attached to the shell:
83+
84+
```bash
85+
sudo docker-compose up approov-token-binding-check
86+
```
87+
88+
or get a bash shell inside the container:
89+
90+
```bash
91+
sudo docker-compose run --rm --service-ports approov-token-binding-check zsh
92+
```
93+
94+
95+
## Issues
96+
97+
If you find any issue while following the example then just open an issue on this repo with the steps to reproduce it and we will help you to solve them.
98+
99+
100+
## Useful Links
101+
102+
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
103+
104+
* [Approov Free Trial](https://approov.io/signup)(no credit card needed)
105+
* [Approov Get Started](https://approov.io/product/demo)
106+
* [Approov QuickStarts](https://approov.io/docs/latest/approov-integration-examples/)
107+
* [Approov Docs](https://approov.io/docs)
108+
* [Approov Blog](https://approov.io/blog/)
109+
* [Approov Resources](https://approov.io/resource/)
110+
* [Approov Customer Stories](https://approov.io/customer)
111+
* [Approov Support](https://approov.zendesk.com/hc/en-gb/requests/new)
112+
* [About Us](https://approov.io/company)
113+
* [Contact Us](https://approov.io/contact)

‎OVERVIEW.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Approov Overview
2+
3+
[Approov](https://approov.io) is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps.
4+
5+
6+
## Why?
7+
8+
You can learn more about Approov, the motives for adopting it, and more detail on how it works by following this [link](https://approov.io/product). In brief, Approov:
9+
10+
* Ensures that accesses to your API come from official versions of your apps; it blocks accesses from republished, modified, or tampered versions
11+
* Protects the sensitive data behind your API; it prevents direct API abuse from bots or scripts scraping data and other malicious activity
12+
* Secures the communication channel between your app and your API with [Approov Dynamic Certificate Pinning](https://approov.io/docs/latest/approov-usage-documentation/#approov-dynamic-pinning). This has all the benefits of traditional pinning but without the drawbacks
13+
* Removes the need for an API key in the mobile app
14+
* Provides DoS protection against targeted attacks that aim to exhaust the API server resources to prevent real users from reaching the service or to at least degrade the user experience.
15+
16+
17+
## How it works?
18+
19+
This is a brief overview of how the Approov cloud service and the backend server fit together from a backend perspective. For a complete overview of how the mobile app and backend fit together with the Approov cloud service and the Approov SDK we recommend to read the [Approov overview](https://approov.io/product) page on our website.
20+
21+
### Approov Cloud Service
22+
23+
The Approov cloud service attests that a device is running a legitimate and tamper-free version of your mobile app.
24+
25+
* If the integrity check passes then a valid token is returned to the mobile app
26+
* If the integrity check fails then a legitimate looking token will be returned
27+
28+
In either case, the app, unaware of the token's validity, adds it to every request it makes to the Approov protected API(s).
29+
30+
### The Backend Server
31+
32+
The backend server ensures that the token supplied in the `Approov-Token` header is present and valid. The validation is done by using a shared secret known only to the Approov cloud service and the backend server.
33+
34+
The request is handled such that:
35+
36+
* If the Approov Token is valid, the request is allowed to be processed by the API endpoint
37+
* If the Approov Token is invalid, an HTTP 401 Unauthorized response is returned
38+
39+
You can choose to log JWT verification failures, but we left it out on purpose so that you can have the choice of how you prefer to do it and decide the right amount of information you want to log.
40+
41+
42+
## Useful Links
43+
44+
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
45+
46+
* [Approov Free Trial](https://approov.io/signup)(no credit card needed)
47+
* [Approov Get Started](https://approov.io/product/demo)
48+
* [Approov QuickStarts](https://approov.io/docs/latest/approov-integration-examples/)
49+
* [Approov Docs](https://approov.io/docs)
50+
* [Approov Blog](https://approov.io/blog/)
51+
* [Approov Resources](https://approov.io/resource/)
52+
* [Approov Customer Stories](https://approov.io/customer)
53+
* [Approov Support](https://approov.zendesk.com/hc/en-gb/requests/new)
54+
* [About Us](https://approov.io/company)
55+
* [Contact Us](https://approov.io/contact)

‎QUICKSTARTS.md

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Approov Integration Quickstarts
2+
3+
[Approov](https://approov.io) is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps.
4+
5+
6+
## The Quickstarts
7+
8+
The quickstart code for the Approov backend server is split into two implementations. The first gets you up and running with basic token checking. The second uses a more advanced Approov feature, _token binding_. Token binding may be used to link the Approov token with other properties of the request, such as user authentication (more details can be found [here](https://approov.io/docs/latest/approov-usage-documentation/#token-binding)).
9+
* [Approov token check quickstart](/docs/APPROOV_TOKEN_QUICKSTART.md)
10+
* [Approov token check with token binding quickstart](/docs/APPROOV_TOKEN_BINDING_QUICKSTART.md)
11+
12+
Both the quickstarts are built from the unprotected example server defined [here](/servers/hello/src/unprotected-server/hello-server-unprotected.js), thus you can use Git to see the code differences between them.
13+
14+
Code difference between the Approov token check quickstart and the original unprotected server:
15+
16+
```
17+
git diff --no-index servers/hello/src/unprotected-server/hello-server-unprotected.js servers/hello/src/approov-protected-server/token-check/hello-server-protected.js
18+
```
19+
20+
You can do the same for the Approov token binding quickstart:
21+
22+
```
23+
git diff --no-index servers/hello/src/unprotected-server/hello-server-unprotected.js servers/hello/src/approov-protected-server/token-binding-check/hello-server-protected.js
24+
```
25+
26+
Or you can compare the code difference between the two quickstarts:
27+
28+
```
29+
git diff --no-index servers/hello/src/approov-protected-server/token-check/hello-server-protected.js servers/hello/src/approov-protected-server/token-binding-check/hello-server-protected.js
30+
```
31+
32+
33+
## Issues
34+
35+
If you find any issue while following our instructions then just report it [here](https://github.com/approov/quickstart-nodejs-express-token-check/issues), with the steps to reproduce it, and we will sort it out and/or guide you to the correct path.
36+
37+
38+
## Useful Links
39+
40+
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
41+
42+
* [Approov Free Trial](https://approov.io/signup)(no credit card needed)
43+
* [Approov Get Started](https://approov.io/product/demo)
44+
* [Approov QuickStarts](https://approov.io/docs/latest/approov-integration-examples/)
45+
* [Approov Docs](https://approov.io/docs)
46+
* [Approov Blog](https://approov.io/blog/)
47+
* [Approov Resources](https://approov.io/resource/)
48+
* [Approov Customer Stories](https://approov.io/customer)
49+
* [Approov Support](https://approov.zendesk.com/hc/en-gb/requests/new)
50+
* [About Us](https://approov.io/company)
51+
* [Contact Us](https://approov.io/contact)

0 commit comments

Comments
 (0)