Hands On Mobile API Security: Get Rid of Client Secrets

tutorials$ git clone https://github.com/approov/hands-on-api-proxy.git

tutorials$ cd api-key-proxy/config
tutorials/api-key-proxy/config$ npm install

tutorials/api-key-proxy/config$ cp secrets.sample.yaml secrets.yaml

# API Key Proxy Secrets Configuration

# specify a fully qualified proxy home url, for example, http://10.0.2.2:8080
proxy_home:           'http://10.0.2.2:8080'

# specify api key string received from NASA
nasa_api_key:         'NASA_API_KEY_VALUE'

# specify approov token secret as a base64 string extracted from approov demo 
approov_token_secret: 'APPROOV_TOKEN_SECRET_VALUE'

# specifiy location of approov android library (approov.aar) extracted from approov demo
approov_android_lib:  '../../demo/libraries/android/approov.aar'

tutorials/api-key-proxy/config$ npm start

<resources>
    <string name="api_url">https://api.nasa.gov</string>
</resources>

<resources>
    <string name="api_key">YOUR_NASA_API_KEY_STRING_HERE</string>
</resources>

tutorials$ cd api-key-proxy/pen/proxy
tutorials/api-key-proxy/pen/proxy$ npm install

module.exports = {
    proxy_port:             /* port the proxy listens on */
        8080,
    nasa_host:              /* NASA API host */
        'api.nasa.gov',
    nasa_protocol:          /* NASA API protocol */
        'https:',
};

module.exports = {
    nasa_api_key:           /* api key received from NASA */
        'NASA_API_KEY_STRING',
};

tutorials/api-key-proxy/pen/proxy$ npm start

<resources>
    <string name="api_url">http://10.0.2.2:8080/api.nasa.gov</string>
</resources>

public class PhotoRequester {

    // ...
  
    public void getPhoto() throws IOException {

        // grab the current calendar date and back up one day for next request

        final String date = mDateFormat.format(mCalendar.getTime());
        mCalendar.add(Calendar.DAY_OF_YEAR, -1);

        // build and call the request

        String urlRequest = mContext.getString(R.string.api_url) +
                BASE_PATH + DATE_PARAMETER + date;
        
        /*    ************ REMOVE API_KEY FROM urlRequest *************
        urlRequest += API_KEY_PARAMETER + mContext.getString(R.string.api_key);
        */
        
        final Request request = new Request.Builder().url(urlRequest).build();
        mLoadingData = true;

        mClient.newCall(request).enqueue(new Callback() {
            @Override
            public void onFailure(Call call, IOException e) {
              // ...
            }

            @Override
            public void onResponse(Call call, Response response) throws IOException {
              // ...
            }
        });
    }
}

module.exports = {
  nasa_api_key:         /* api key received from NASA */
      'YOUR NASA API KEY STRING HERE',
  approov_token_secret: /* token secret received from Approov demo download */
      'APPROOV DEMO TOKEN SECRET BASE64 STRING HERE',
};

module.exports = {
    proxy_port:             /* port the proxy listens on */
        8080,
    nasa_host:              /* NASA API host */
        'api.nasa.gov',
    nasa_protocol:          /* NASA API protocol */
        'https:',
    approov_header:         /* Approov header name */
        'approov',
    approov_enforcement:    /* set true to enforce token checks */
        true,
};

// preprocess all proxy requests

app.use((req, res, next) => {
  // just pass through each request

  //log_req(req);

  next();
});

// load and check approov token checking

const approov = require(`${__dirname}/approov`);

if (config.approov_header == null) {
  throw new Error(`approov_header not found; please set in ${__dirname}/config.js`);
}
const approovHdr = config.approov_header;

// preprocess all proxy requests

app.use((req, res, next) => {
  // check and delete approov token

  //log_req(req);

  var token = req.headers[approovHdr];
  delete req.headers[approovHdr];

  if (!approov.isValid(token)) {
    console.log(chalk.red('Unauthorized: invalid Approov token'));
    res.status(401).send('Unauthorized');
    return;
  }

  next();
});

package com.criticalblue.android.astropiks;

import android.app.Application;
import android.util.Log;

import com.criticalblue.attestationlibrary.ApproovAttestation;
import com.criticalblue.attestationlibrary.ApproovConfig;
import com.criticalblue.attestationlibrary.TokenInterface;
import com.jakewharton.picasso.OkHttp3Downloader;
import com.squareup.picasso.Picasso;

import java.io.IOException;
import java.net.MalformedURLException;

import okhttp3.Interceptor;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.Response;

/**
 * Represents the astropix application.
 *
 * This is only used to hold a long running Approov attestation object
 * throughout the running activities.
 */
public class App extends Application {
    final static String TAG = "APP";

    OkHttpClient mClient = null;
    Picasso mDownloader = null;

    /**
     * Adds Approov attestation token to http requests.
     */
    private class ApproovInterceptor implements Interceptor {

        /**
         * Intercepts the http request and adds the approov token to the request headers.
         *
         * @param chain the request chain.
         * @return the augmented request.
         * @throws IOException on I/O error.
         */
        @Override
        public Response intercept(Chain chain) throws IOException {
            Request request = chain.request();

            TokenInterface.ApproovResults approovResults =
                    ApproovAttestation.shared().fetchApproovTokenAndWait(null);
            String token;
            if (approovResults.getResult() == ApproovAttestation.AttestationResult.SUCCESS) {
                token = approovResults.getToken();
            } else {
                token = "NOTOKEN";
            }
            request = request.newBuilder().addHeader("approov", token).build();

            return chain.proceed(request);
        }
    }

    @Override
    public void onCreate (){
        super.onCreate();

        // Initialize the Approov SDK
        try {
            // Creates the configuration object for the Approov SDK based
            // on the Android application context
            ApproovConfig config =
                    ApproovConfig.getDefaultConfig(this.getApplicationContext());
            ApproovAttestation.initialize(config);
        } catch (IllegalArgumentException ex) {
            Log.e(TAG, ex.getMessage());
        } catch (MalformedURLException ex) {
            Log.e(TAG, ex.getMessage());
        }

        mClient = new OkHttpClient.Builder()
                .addInterceptor(new ApproovInterceptor())
                .build();
        mDownloader = new Picasso.Builder(this)
                .downloader(new OkHttp3Downloader(mClient))
                .build();
    }

    /**
     * Returns a client for http requests.
     *
     * @return an http client.
     */
    public OkHttpClient getHttpClient() {
        return mClient;
    }

    /**
     * Returns an image downloader for http requests.
     *
     * @return an http downloader.
     */
    public Picasso getImageDownloader() {
        return mDownloader;
    }
}

tutorial$ cd demo/registration-tools/Android/Linux
tutorial$ ./registration -a ~/tutorial/api-key-proxy/pen/client/app/
build/outputs/apk/app-debug.apk -t ../../registration_access.tok 
-e 2d
Submitting data…
Success: new app signature added to database.
You can check in the Approov portal that signature vmz6h52XaGJ5VZPWC5W4YQ6kWlU7KR0im/NrVhQclas= has been added to the library 1490625733147480904

const path = require('path');
const url = require('url');
const request = require('request');
const chalk = require('chalk');

// load api configuration and secrets

const config = require(`${__dirname}/../config.js`);

if (config.nasa_host == null) {
  throw new Error(`nasa_host not found; please set in ${__dirname}/../config.js`);
}
const api_host = config.nasa_host;

if (config.nasa_protocol == null) {
  throw new Error(`nasa_protocol not found; please set in ${__dirname}/../config.js`);
}
const api_protocol = config.nasa_protocol;

const secrets = require(`${__dirname}/../secrets.js`);

if (secrets.nasa_api_key == null) {
  throw new Error(`nasa_api_key not found; please set in ${__dirname}/../secrets.js`);
}
const api_key = secrets.nasa_api_key;

const apodHostname = 'apod.nasa.gov';
const apodRoute = '/' + apodHostname + '/apod/image/*'
const apodDirect = api_protocol + '//' + apodHostname + '/';
const apodDirectRe = new RegExp(apodDirect.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&'), 'g');

/**
 * Describes NASA API route handlers.
 *
 * @param app the express app.
 */
function routes(app) {

  // proxy a picture of the day request

  app.use(`/${api_host}`, (req, res, next) => {
    console.log('Processing NASA API request');

    // build redirected request

    var urlInfo = url.parse(req.url, true);  // build proxied url
    urlInfo.protocol = api_protocol;
    urlInfo.host  = api_host;
    // urlInfo.pathname is req.url
    delete urlInfo.search;
    urlInfo.query.api_key = api_key;         // add nasa api key
    var nasaUrl = url.format(urlInfo);

    var proxyHome = req.protocol + '://' + req.headers.host;
    var apodProxy = proxyHome + '/' + apodHostname + '/';

    var nasaHdrs = req.headers;              // reuse most headers
    delete nasaHdrs['host'];
    delete nasaHdrs['accept-encoding'];

    // start proxy request

    request({ url: nasaUrl, headers: nasaHdrs }, (err, proxyRes, proxyBody) => {
      if (err) {
        console.log(chalk.red(`Internal Server Error: in NASA proxy: ${err}`));
        res.status(500).send('Internal Server Error');
      } else {

        // patch response to redirect any apod image requests through proxy

        proxyBody = proxyBody.replace(apodDirectRe, apodProxy);
        proxyRes.headers["content-length"] = proxyBody.length.toString();

        res.writeHead(proxyRes.statusCode, proxyRes.headers);
        res.write(proxyBody);
        res.end();
      }
    });
  });

  // proxy a picture of the day image download

  app.get(apodRoute, (req, res, next) => {
    console.log('Processing NASA apod image request', api_protocol + '/' + req.url);

    // console.log('image headers:', JSON.stringify(req.headers, null, '  '));

    // pipe the image request through the proxy

    let proxyUrl = api_protocol + '/' + req.url;
    let proxyReq = request(proxyUrl);

    req.pipe(proxyReq).pipe(res);
  });
}

module.exports = { routes: routes };