Systems and/or methods implementing hybrid approach using JWT token and symmetric hashing
View Patent ↗An API gateway receives, from an application, a callback-related request and a registration token including a callback URL usable by an API server to call the callback server and security data for the callback URL. If that token's signature is valid: the callback URL, the security data for the callback URL, and an identifier identifying the API and callback servers are stored; a replacement URL is generated using the identifier; and the replacement URL is registered with the API server. When the API server emits an event regarding a registered request: the security data is retrieved for the associated request; a secure token is generated using that data and event-related content; the callback URL is retrieved for the associated request; and the retrieved callback URL, the secure token, and event-related content are sent to the callback server. The callback server determines whether event-related content is trustworthy using the secure token.
1. A system for securing callbacks generated by an API server in response to a callback-related request from a client application for a callback server, the system comprising an API gateway, the API gateway comprising:
a data store; and
at least one processor configured to perform operations comprising:
receiving, from the client application, the callback-related request and a registration token including data specifying a callback URL usable by the API server to call the callback server and data specifying how the callback URL is to be secured, wherein the registration token is structured to include a header, a payload, and a signature;
validating the signature of the received registration token;
in response to a determination that the signature of the received registration token is valid:
storing details regarding the callback-related request to a data structure in the data store, the details regarding the callback-related request including the callback URL, the data specifying how the callback URL is to be secured, and an identifier that identifies the API server and the callback server;
generating a replacement URL based on the identifier; and
sending the replacement URL to the API server to register the callback-related request with the API server; and
in response to receipt of an event emitted by the API server in response to a registered callback-related request:
retrieving the data specifying how the callback URL is to be secured for the registered callback-related request associated with the received event;
generating a secure token based on the data specifying how the callback URL is to be secured for the registered callback-related request associated with the received event, and content for the event;
retrieving the callback URL for the registered callback-related request associated with the received event; and
sending, to the callback server, via the retrieved callback URL, the secure token and the content for the event;
wherein the callback server is configured to determine whether the content for the event is trustworthy based on the secure token.
2. The system of claim 1 , wherein the data specifying how the callback URL is to be secured includes a secret key of the callback server and a hashing algorithm.
3. The system of claim 2 , wherein the payload of the registration token includes the secret key and the hashing algorithm.
4. The system of claim 3 , wherein the secret key and the hashing algorithm are private claims in the payload of the registration token.
5. The system of claim 2 , wherein the secure token is generated by hashing (a) a hash of an event payload for the event, and (b) a hash of the secret key for the registered callback-related request associated with the received event, and wherein each hash is performed using the hashing algorithm specified in the payload of the registration token.
6. The system of claim 2 , wherein the secret key is generated by the client application for the callback server.
7. The system of claim 1 , wherein the identifier is usable as a key to the data structure.
8. The system of claim 1 , the registration token is signed with a public key of the API Gateway and a private key of the Client Application.
9. The system of claim 1 , wherein the API gateway is configured to process a plurality of callback-related requests from a plurality of client applications for a plurality of callback servers, wherein details regarding the plurality of callback-related requests are stored to the data store.
10. The system of claim 1 , wherein the callback server is configured to determine whether the content for the event is trustworthy based on the secure token by performing operations comprising recalculating a value for the secure token and determining whether the recalculated value matches the secure token.
11. The system of claim 1 , wherein the callback server resides outside of the client application.
12. A method for securing callbacks generated by an API server in response to a callback-related request from a client application for a callback server, the method comprising:
receiving, at an API gateway and from the client application, the callback-related request and a registration token including data specifying a callback URL usable by the API server to call the callback server and data specifying how the callback URL is to be secured, wherein the registration token is structured to include a header, a payload, and a signature;
validating the signature of the received registration token;
in response to a determination that the signature of the received registration token is valid:
storing details regarding the callback-related request, the details regarding the callback-related request including the callback URL, the data specifying how the callback URL is to be secured, and an identifier that identifies the API server and the callback server;
generating a replacement URL based on the identifier; and
sending the replacement URL from the API gateway to the API server to register the callback-related request with the API server; and
in response to receipt of an event emitted by the API server in response to a registered callback-related request:
retrieving the data specifying how the callback URL is to be secured for the registered callback-related request associated with the received event;
generating a secure token based on the data specifying how the callback URL is to be secured for the registered callback-related request associated with the received event, and content for the event;
retrieving the callback URL for the registered callback-related request associated with the received event; and
sending, to the callback server, via the retrieved callback URL, the secure token and the content for the event;
wherein the callback server is configured to determine whether the content for the event is trustworthy based on the secure token.
13. The method of claim 12 , wherein the data specifying how the callback URL is to be secured includes a secret key of the callback server and a hashing algorithm.
14. The method of claim 13 , wherein the payload of the registration token includes the secret key and the hashing algorithm.
15. The method of claim 13 , wherein the secure token is generated by hashing (a) a hash of an event payload for the event, and (b) a hash of the secret key for the registered callback-related request associated with the received event, and wherein each hash is performed using the hashing algorithm specified in the payload of the registration token.
16. The method of claim 12 , wherein the callback server is configured to determine whether the content of the event is trustworthy based on the secure token by performing operations comprising recalculating a value for the secure token and determining whether the recalculated value matches the secure token.
17. The method of claim 12 , wherein the callback server resides outside of the client application.
18. A non-transitory computer readable storage medium tangibly storing instructions that, when executed by at least one processor of an API gateway, perform the method of claim 12 .
19. The non-transitory computer readable storage medium of claim 18 , wherein the callback server resides outside of the client application.
20. An API gateway system configured to secure callbacks generated by an API server in response to a callback-related request from a client application for a callback server, the API gateway comprising:
a data store; and
at least one processor configured to perform operations comprising:
receiving, from the client application, the callback-related request and a registration token including data specifying a callback URL usable by the API server to call the callback server and data specifying how the callback URL is to be secured, wherein the registration token is structured to include a header, a payload, and a signature;
validating the signature of the received registration token;
in response to a determination that the signature of the received registration token is valid:
storing details regarding the callback-related request to a data structure in the data store, the details regarding the callback-related request including the callback URL, the data specifying how the callback URL is to be secured, and an identifier that identifies the API server and the callback server;
generating a replacement URL based on the identifier; and
sending the replacement URL to the API server to register the callback-related request with the API server; and
in response to receipt of an event emitted by the API server in response to a registered callback-related request:
retrieving the data specifying how the callback URL is to be secured for the registered callback-related request associated with the received event;
generating a secure token based on the data specifying how the callback URL is to be secured for the registered callback-related request associated with the received event, and content for the event;
retrieving the callback URL for the registered callback-related request associated with the received event; and
sending, to the callback server, via the retrieved callback URL, the secure token and the content for the event;
wherein the callback server is configured to determine whether the content for the event is trustworthy based on the secure token.
21. The system of claim 20 , wherein the data specifying how the callback URL is to be secured includes a secret key of the callback server and a hashing algorithm.
22. The system of claim 21 , wherein the payload of the registration token includes the secret key and the hashing algorithm.
23. The system of claim 21 , wherein the secure token is generated by hashing (a) a hash of an event payload for the event, and (b) a hash of the secret key for the registered callback-related request associated with the received event, and wherein each hash is performed using the hashing algorithm specified in the payload of the registration token.
24. The system of claim 20 , wherein the callback server is configured to determine whether the content of the event is trustworthy based on the secure token by performing operations comprising recalculating a value for the secure token and determining whether the recalculated value matches the secure token.
25. The system of claim 20 , wherein the callback server resides outside of the client application.