Skip to content

Commit 3d79a33

Browse files
committed
Moved the quickstart to the simpler format.
Signed-off-by: Exadra37 <exadra37@gmail.com>
1 parent 30bfe71 commit 3d79a33

File tree

12 files changed

+410
-84
lines changed

12 files changed

+410
-84
lines changed
File renamed without changes.

servers/hello/README.md renamed to EXAMPLES.md

+23-7
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ If you are looking for the Approov quickstarts to integrate Approov in your Pyth
1111

1212
To learn more about each Hello server example you need to read the README for each one at:
1313

14-
* [Unprotected Server](./src/unprotected-server)
15-
* [Approov Protected Server - Token Check](./src/approov-protected-server/token-check)
16-
* [Approov Protected Server - Token Binding Check](./src/approov-protected-server/token-binding-check)
14+
* [Unprotected Server](./servers/hello/src/unprotected-server)
15+
* [Approov Protected Server - Token Check](./servers/hello/src/approov-protected-server/token-check)
16+
* [Approov Protected Server - Token Binding Check](./servers/hello/src/approov-protected-server/token-binding-check)
1717

1818

1919
## Docker Stack
@@ -27,8 +27,8 @@ If you decide to use the docker stack then you need to bear in mind that the Pos
2727
Do not forget to properly setup the `.env` file in the root of each Approov protected server example before you run the server with the docker stack.
2828

2929
```bash
30-
cp src/approov-protected-server/token-check/.env.example src/approov-protected-server/token-check/.env
31-
cp src/approov-protected-server/token-binding-check/.env.example src/approov-protected-server/token-binding-check/.env
30+
cp servers/hello/src/approov-protected-server/token-check/.env.example servers/hello/src/approov-protected-server/token-check/.env
31+
cp servers/hello/src/approov-protected-server/token-binding-check/.env.example servers/hello/src/approov-protected-server/token-binding-check/.env
3232
```
3333

3434
Edit each file and add the [dummy secret](/README.md#the-dummy-secret) to it in order to be able to test the Approov integration with the provided [Postman collection](https://github.com/approov/postman-collections/blob/master/quickstarts/hello-world/hello-world.postman_curl_requests_examples.md).
@@ -89,6 +89,22 @@ or get a bash shell inside the container:
8989
sudo docker-compose run --rm --service-ports approov-token-binding-check zsh
9090
```
9191

92-
## Support
92+
## Issues
9393

94-
If you find any issue while following this quickstart then just open an issue on this repo with the steps to reproduce it and we will help you to solve them.
94+
If you find any issue while following our instructions then just report it [here](https://github.com/approov/quickstart-python-flask-token-check/issues), with the steps to reproduce it, and we will sort it out and/or guide you to the correct path.
95+
96+
97+
## Useful Links
98+
99+
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
100+
101+
* [Approov Free Trial](https://approov.io/signup)(no credit card needed)
102+
* [Approov Get Started](https://approov.io/product/demo)
103+
* [Approov QuickStarts](https://approov.io/docs/latest/approov-integration-examples/)
104+
* [Approov Docs](https://approov.io/docs)
105+
* [Approov Blog](https://approov.io/blog/)
106+
* [Approov Resources](https://approov.io/resource/)
107+
* [Approov Customer Stories](https://approov.io/customer)
108+
* [Approov Support](https://approov.zendesk.com/hc/en-gb/requests/new)
109+
* [About Us](https://approov.io/company)
110+
* [Contact Us](https://approov.io/contact)

OVERVIEW.md

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Approov Overview
2+
3+
[Approov](https://approov.io) is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps.
4+
5+
6+
## Why?
7+
8+
You can learn more about Approov, the motives for adopting it, and more detail on how it works by following this [link](https://approov.io/product). In brief, Approov:
9+
10+
* Ensures that accesses to your API come from official versions of your apps; it blocks accesses from republished, modified, or tampered versions
11+
* Protects the sensitive data behind your API; it prevents direct API abuse from bots or scripts scraping data and other malicious activity
12+
* Secures the communication channel between your app and your API with [Approov Dynamic Certificate Pinning](https://approov.io/docs/latest/approov-usage-documentation/#approov-dynamic-pinning). This has all the benefits of traditional pinning but without the drawbacks
13+
* Removes the need for an API key in the mobile app
14+
* Provides DoS protection against targeted attacks that aim to exhaust the API server resources to prevent real users from reaching the service or to at least degrade the user experience.
15+
16+
17+
## How it works?
18+
19+
This is a brief overview of how the Approov cloud service and the backend server fit together from a backend perspective. For a complete overview of how the mobile app and backend fit together with the Approov cloud service and the Approov SDK we recommend to read the [Approov overview](https://approov.io/product) page on our website.
20+
21+
### Approov Cloud Service
22+
23+
The Approov cloud service attests that a device is running a legitimate and tamper-free version of your mobile app.
24+
25+
* If the integrity check passes then a valid token is returned to the mobile app
26+
* If the integrity check fails then a legitimate looking token will be returned
27+
28+
In either case, the app, unaware of the token's validity, adds it to every request it makes to the Approov protected API(s).
29+
30+
### The Backend Server
31+
32+
The backend server ensures that the token supplied in the `Approov-Token` header is present and valid. The validation is done by using a shared secret known only to the Approov cloud service and the backend server.
33+
34+
The request is handled such that:
35+
36+
* If the Approov Token is valid, the request is allowed to be processed by the API endpoint
37+
* If the Approov Token is invalid, an HTTP 401 Unauthorized response is returned
38+
39+
You can choose to log JWT verification failures, but we left it out on purpose so that you can have the choice of how you prefer to do it and decide the right amount of information you want to log.
40+
41+
42+
## Useful Links
43+
44+
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
45+
46+
* [Approov Free Trial](https://approov.io/signup)(no credit card needed)
47+
* [Approov Get Started](https://approov.io/product/demo)
48+
* [Approov QuickStarts](https://approov.io/docs/latest/approov-integration-examples/)
49+
* [Approov Docs](https://approov.io/docs)
50+
* [Approov Blog](https://approov.io/blog/)
51+
* [Approov Resources](https://approov.io/resource/)
52+
* [Approov Customer Stories](https://approov.io/customer)
53+
* [Approov Support](https://approov.zendesk.com/hc/en-gb/requests/new)
54+
* [About Us](https://approov.io/company)
55+
* [Contact Us](https://approov.io/contact)

QUICKSTARTS.md

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Approov Integration Quickstarts
2+
3+
[Approov](https://approov.io) is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps.
4+
5+
6+
## The Quickstarts
7+
8+
The quickstart code for the Approov backend server is split into two implementations. The first gets you up and running with basic token checking. The second uses a more advanced Approov feature, _token binding_. Token binding may be used to link the Approov token with other properties of the request, such as user authentication (more details can be found [here](https://approov.io/docs/latest/approov-usage-documentation/#token-binding)).
9+
* [Approov token check quickstart](/docs/APPROOV_TOKEN_QUICKSTART.md)
10+
* [Approov token check with token binding quickstart](/docs/APPROOV_TOKEN_BINDING_QUICKSTART.md)
11+
12+
Both the quickstarts are built from the unprotected example server defined [here](/servers/hello/src/unprotected-server/hello-server-unprotected.py), thus you can use Git to see the code differences between them.
13+
14+
Code difference between the Approov token check quickstart and the original unprotected server:
15+
16+
```
17+
git diff --no-index servers/hello/src/unprotected-server/hello-server-unprotected.py servers/hello/src/approov-protected-server/token-check/hello_server_protected.py
18+
```
19+
20+
You can do the same for the Approov token binding quickstart:
21+
22+
```
23+
git diff --no-index servers/hello/src/unprotected-server/hello-server-unprotected.py servers/hello/src/approov-protected-server/token-binding-check/hello_server_protected.py
24+
```
25+
26+
Or you can compare the code difference between the two quickstarts:
27+
28+
```
29+
git diff --no-index servers/hello/src/approov-protected-server/token-check/hello_server_protected.py servers/hello/src/approov-protected-server/token-binding-check/hello_server_protected.py
30+
```
31+
32+
## Issues
33+
34+
If you find any issue while following our instructions then just report it [here](https://github.com/approov/quickstart-python-flask-token-check/issues), with the steps to reproduce it, and we will sort it out and/or guide you to the correct path.
35+
36+
37+
## Useful Links
38+
39+
If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point:
40+
41+
* [Approov Free Trial](https://approov.io/signup)(no credit card needed)
42+
* [Approov Get Started](https://approov.io/product/demo)
43+
* [Approov QuickStarts](https://approov.io/docs/latest/approov-integration-examples/)
44+
* [Approov Docs](https://approov.io/docs)
45+
* [Approov Blog](https://approov.io/blog/)
46+
* [Approov Resources](https://approov.io/resource/)
47+
* [Approov Customer Stories](https://approov.io/customer)
48+
* [Approov Support](https://approov.zendesk.com/hc/en-gb/requests/new)
49+
* [About Us](https://approov.io/company)
50+
* [Contact Us](https://approov.io/contact)

0 commit comments

Comments
 (0)