Skip to content

Latest commit

 

History

History
55 lines (34 loc) · 3.22 KB

OVERVIEW.md

File metadata and controls

55 lines (34 loc) · 3.22 KB
Raw

Approov Overview

Approov is an API security solution used to verify that requests received by your backend services originate from trusted versions of your mobile apps.

Why?

You can learn more about Approov, the motives for adopting it, and more detail on how it works by following this link. In brief, Approov:

  • Ensures that accesses to your API come from official versions of your apps; it blocks accesses from republished, modified, or tampered versions
  • Protects the sensitive data behind your API; it prevents direct API abuse from bots or scripts scraping data and other malicious activity
  • Secures the communication channel between your app and your API with Approov Dynamic Certificate Pinning. This has all the benefits of traditional pinning but without the drawbacks
  • Removes the need for an API key in the mobile app
  • Provides DoS protection against targeted attacks that aim to exhaust the API server resources to prevent real users from reaching the service or to at least degrade the user experience.

How it works?

This is a brief overview of how the Approov cloud service and the backend server fit together from a backend perspective. For a complete overview of how the mobile app and backend fit together with the Approov cloud service and the Approov SDK we recommend to read the Approov overview page on our website.

Approov Cloud Service

The Approov cloud service attests that a device is running a legitimate and tamper-free version of your mobile app.

  • If the integrity check passes then a valid token is returned to the mobile app
  • If the integrity check fails then a legitimate looking token will be returned

In either case, the app, unaware of the token's validity, adds it to every request it makes to the Approov protected API(s).

The Backend Server

The backend server ensures that the token supplied in the Approov-Token header is present and valid. The validation is done by using a shared secret known only to the Approov cloud service and the backend server.

The request is handled such that:

  • If the Approov Token is valid, the request is allowed to be processed by the API endpoint
  • If the Approov Token is invalid, an HTTP 401 Unauthorized response is returned

You can choose to log JWT verification failures, but we left it out on purpose so that you can have the choice of how you prefer to do it and decide the right amount of information you want to log.

Useful Links

If you wish to explore the Approov solution in more depth, then why not try one of the following links as a jumping off point: