Token authentication

Enable application authentication

1. In the Web application list under Recently Developed, find the target application and click the application name.
2. In the left-side navigation pane of the web-based visualization editor, click the Application settings button.
3. On the Application authentication tab, click the switch next to token. In the confirmation dialog box, click Enable.
   After you enable token authentication, the system automatically generates a token for the application. Click the view icon to show the token.
4. Integrate the token signature into the application access URL.
   After you enable token authentication, users can no longer access your application using the original URL. You must integrate the token signature into the URL querystring.
   1. Convert the current time in milliseconds to a string.
   2. Use the token to sign the string from the previous step with HMAC-SHA256 and encode the result in Base64.
      Note To ensure application security, the calculated signature is valid for 32 hours. After this period, you must calculate a new signature.
   3. Append the timestamp and the signature to the URL querystring as the time and signature parameters, respectively.
   4. Test the URL.
      Access the application using the URL that contains the token signature.
   The following code samples show how to integrate the access URL.

   • PHP sample code:

     <?php
       $token = "54cc8224a92ddda750600157e17b****";
       $time = time()*1000;
       $stringToSign = strval($time);
       $signature = urlencode(base64_encode(hash_hmac('sha256', $stringToSign, $token, true)));
       $url = "http://<your_application_access_URL>"."?time=".$time."&signature=".$signature;
     ?>
     <iframe width=100% height=100% src="<?=$url?>"/>

   • Node.js sample code:

     const crypto = require('crypto');
     var token = "54cc8224a92ddda750600157e17b****";
     var time = Date.now();
     var stringToSign = time.toString();
     var signature = crypto.createHmac('sha256', token).update(stringToSign).digest().toString('base64');
     var url="http://<your_application_access_URL>"+"?time="+time+"&signature="+ encodeURIComponent(signature);

   • Java sample code:

     package com.company;
     import java.security.*;
     import java.util.Date;
     import javax.crypto.*;
     import javax.crypto.spec.SecretKeySpec;
     import org.apache.commons.codec.binary.Base64;
     import java.net.URLEncoder;
     /**
      * Created by studio on 2019/4/3.
      */
     public class TokenTest {
         public static String getSignedUrl(String token){
             Date date = new Date();
             Long time = date.getTime();
             String stringToSign = String.valueOf(time);
             String signature = HMACSHA256(stringToSign.getBytes(), token.getBytes());
             String url = "http://<your_application_access_URL>"+"?time="+time+"&signature="+ signature;
             return url;
         }
         /**
          * Implements HMAC-SHA256 signing by using native Java classes.
          * @param data The data to be signed.
          * @param key The signing key.
          * @return The URL-encoded and Base64-encoded signature string.
          */
         public static String HMACSHA256(byte[] data, byte[] key)
         {
             try  {
                 SecretKeySpec signingKey = new SecretKeySpec(key, "HmacSHA256");
                 Mac mac = Mac.getInstance("HmacSHA256");
                 mac.init(signingKey);
                 return URLEncoder.encode(byte2Base64(mac.doFinal(data)));
             } catch (NoSuchAlgorithmException e) {
                 e.printStackTrace();
             } catch (InvalidKeyException e) {
                 e.printStackTrace();
             }
             return null;
         }
         private static String byte2Base64(byte[] bytes){
             return Base64.encodeBase64String(bytes);
         }
         public static void main(String[] args) throws Exception {
             String token = "54cc8224a92ddda750600157e17b****";
             System.out.println(getSignedUrl(token));
         }
     }

Enable instance token authentication

After you publish an application, new application instances generated from device bindings can inherit the application's token. You can also generate a separate token for an instance or disable token authentication for it.

1. In the left-side navigation pane of the application editor, click the Device binding management button.
   The Application-bound devices page displays the configurations (which are application instances) for all bound devices. Each device configuration generates an independent application instance.

   If you need to add a new application instance, click New Device Configuration and then bind a device. For instructions on device configuration, see Bind Devices in Batches.

2. On the Application-bound devices page, click Token configuration next to the device configuration name.
3. On the Token settings page, select one of the following options and click OK.
   • Same as application: The instance inherits the application's token. If token authentication is disabled for the application, it is also disabled for this instance.

     This option is typically used when the application and its instances are part of the same project and do not need to be isolated.

   • Enable independent token authentication: The system generates a unique token for this instance, and the inherited application token becomes invalid. You must update the access URL configuration accordingly. The URL integration method is the same as described in Step 5 of the 'Enable application authentication' section.

     This option is typically used when independent security verification is required, such as for an application instance that is delivered independently.

   • Disabled: Disables token authentication for the instance. No security verification is performed.

     This option is typically used for application instances that are delivered independently and do not require security verification.