sdk-base

Secure Native SDK in java

License

License

Categories

Categories

Java Languages Native Development Tools
GroupId

GroupId

com.securenative.java
ArtifactId

ArtifactId

sdk-base
Last Version

Last Version

0.3.0
Release Date

Release Date

Type

Type

jar
Description

Description

sdk-base
Secure Native SDK in java
Project URL

Project URL

https://github.com/securenative/securenative-java
Source Code Management

Source Code Management

http://github.com/securenative/securenative-java/tree/master

Download sdk-base

How to add to project

<!-- https://jarcasting.com/artifacts/com.securenative.java/sdk-base/ -->
<dependency>
    <groupId>com.securenative.java</groupId>
    <artifactId>sdk-base</artifactId>
    <version>0.3.0</version>
</dependency>
// https://jarcasting.com/artifacts/com.securenative.java/sdk-base/
implementation 'com.securenative.java:sdk-base:0.3.0'
// https://jarcasting.com/artifacts/com.securenative.java/sdk-base/
implementation ("com.securenative.java:sdk-base:0.3.0")
'com.securenative.java:sdk-base:jar:0.3.0'
<dependency org="com.securenative.java" name="sdk-base" rev="0.3.0">
  <artifact name="sdk-base" type="jar" />
</dependency>
@Grapes(
@Grab(group='com.securenative.java', module='sdk-base', version='0.3.0')
)
libraryDependencies += "com.securenative.java" % "sdk-base" % "0.3.0"
[com.securenative.java/sdk-base "0.3.0"]

Dependencies

compile (15)

Group / Artifact Type Version
com.fasterxml.jackson.core : jackson-databind jar 2.9.10.1
org.apache.maven : maven-model jar 3.0.2
org.asynchttpclient : async-http-client jar 2.2.0
net.bytebuddy : byte-buddy-agent jar 1.10.1
org.reflections : reflections jar 0.9.11
net.bytebuddy : byte-buddy jar 1.9.16
org.apache.logging.log4j : log4j-api jar 2.11.2
commons-codec : commons-codec jar 1.11
org.springframework : spring-core jar 3.2.3.RELEASE
org.springframework : spring-context jar 3.2.3.RELEASE
org.springframework.security : spring-security-config jar 4.1.3.RELEASE
org.springframework.security : spring-security-web jar 4.1.3.RELEASE
org.json : json jar 20190722
com.amazonaws : aws-java-sdk-waf jar 1.11.714
org.jetbrains : annotations jar RELEASE

provided (1)

Group / Artifact Type Version
javax.servlet : servlet-api jar 2.5

test (2)

Group / Artifact Type Version
junit : junit jar 4.12
org.mockito : mockito-core jar 2.21.0

Project Modules

There are no modules declared in this project.

SecureNative Logo

A Cloud-Native Security Monitoring and Protection for Modern Applications

Github Actions npm version

Documentation | Quick Start | Blog | Chat with us on Slack!


SecureNative performs user monitoring by analyzing user interactions with your application and various factors such as network, devices, locations and access patterns to stop and prevent account takeover attacks.

Install the SDK

When using Maven, add the following dependency to your pom.xml file:

<dependency>
    <groupId>com.securenative.java</groupId>
    <artifactId>securenative-java</artifactId>
    <version>LATEST</version>
</dependency>

When using Gradle, add the following dependency to your build.gradle file:

compile group: 'com.securenative.java', name: 'sdk-parent', version: '0.3.1', ext: 'pom'

When using SBT, add the following dependency to your build.sbt file:

libraryDependencies += "com.securenative.java" % "sdk-parent" % "0.3.1" pomOnly()

Initialize the SDK

To get your API KEY, login to your SecureNative account and go to project settings page:

Option 1: Initialize via Config file

SecureNative can automatically load your config from securenative.properties file or from the file that is specified in your SECURENATIVE_CONFIG_FILE env variable:

// Options 1: Use default config file path
try {
    SecureNative securenative =  SecureNative.init();
} catch (SecureNativeSDKException | SecureNativeConfigException e) {
    e.printStackTrace();
}

// Options 2: Use specific config file path
Path path = Paths.get("/path/to/securenative.properties");
try {
    SecureNative.init(path);
} catch (SecureNativeSDKException | SecureNativeConfigException e) {
    System.err.printf("Could not initialize SecureNative sdk; %s%n", e);
}

Option 2: Initialize via API Key

try {
   SecureNative securenative =  SecureNative.init("YOUR_API_KEY");
} catch (SecureNativeSDKException | SecureNativeConfigException e) {
   e.printStackTrace();
}

Option 3: Initialize via ConfigurationBuilder

try {
    securenative = SecureNative.init(SecureNative.configBuilder()
        .withApiKey("API_KEY")
        .withMaxEvents(10)
        .withLogLevel("error")
        .build());
} catch (SecureNativeSDKException e) {
    e.printStackTrace();
}

Getting SecureNative instance

Once initialized, sdk will create a singleton instance which you can get:

SecureNative securenative = null;
try {
    securenative = SecureNative.getInstance();
} catch (SecureNativeSDKIllegalStateException e) {
    System.err.printf("Could not get SecureNative instance; %s%n", e);
}

Tracking events

Once the SDK has been initialized, tracking requests sent through the SDK instance. Make sure you build event with the EventBuilder:

@RequestMapping("/track")
public void track() {
   SecureNative securenative = null;
   try {
       securenative = SecureNative.getInstance();
   } catch (SecureNativeSDKIllegalStateException e) {
       System.err.printf("Could not get SecureNative instance; %s%n", e);
   }
   
   SecureNativeContext context = SecureNative.contextBuilder()
           .withIp("37.86.255.94")
           .withClientToken("SECURENATIVE_CLIENT_TOKEN")
           .withHeaders(Maps.defaultBuilder()
                   .put("user-agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36")
                   .build())
           .build();
   
   EventOptions eventOptions = null;
   try {
       eventOptions = EventOptionsBuilder.builder(EventTypes.LOG_IN)
               .userId("1234")
               .userTraits("Your Name", "[email protected]", "+1234567890")
               .context(context)
               .properties(Maps.builder()
                       .put("prop1", "CUSTOM_PARAM_VALUE")
                       .put("prop2", true)
                       .put("prop3", 3)
                       .build())
               .timestamp(new Date())
               .build();
   } catch (SecureNativeInvalidOptionsException e) {
       e.printStackTrace();
   }
   
   try {
       securenative.track(eventOptions);
   } catch (SecureNativeInvalidOptionsException e) {
       e.printStackTrace();
   }
}

You can also create request context from HttpServletRequest:

@RequestMapping("/track")
public void track(HttpServletRequest request, HttpServletResponse response) {
    SecureNative securenative = null;
    try {
        securenative = SecureNative.getInstance();
    } catch (SecureNativeSDKIllegalStateException e) {
        System.err.printf("Could not get SecureNative instance; %s%n", e);
    }

    SecureNativeContext context = securenative.fromHttpServletRequest(request).build();

    EventOptions eventOptions = null;
    try {
        eventOptions = EventOptionsBuilder.builder(EventTypes.LOG_IN)
                .userId("1234")
                .userTraits("Your Name", "[email protected]", "+1234567890")
                .context(context)
                .properties(Maps.builder()
                        .put("prop1", "CUSTOM_PARAM_VALUE")
                        .put("prop2", true)
                        .put("prop3", 3)
                        .build())
                .timestamp(new Date())
                .build();
    } catch (SecureNativeInvalidOptionsException e) {
        e.printStackTrace();
    }

    try {
        securenative.track(eventOptions);
    } catch (SecureNativeInvalidOptionsException e) {
        e.printStackTrace();
    }
}

Verify events

Example

@RequestMapping("/verify")
public void verify(HttpServletRequest request, HttpServletResponse response) {
SecureNative securenative = null;
    try {
        securenative = SecureNative.getInstance();
    } catch (SecureNativeSDKIllegalStateException e) {
        System.err.printf("Could not get SecureNative instance; %s%n", e);
    }

    SecureNativeContext context = securenative.fromHttpServletRequest(request).build();
    
    EventOptions eventOptions = null;
    try {
        eventOptions = EventOptionsBuilder.builder(EventTypes.LOG_IN)
                .userId("1234")
                .userTraits("Your Name", "[email protected]", "+1234567890")
                .context(context)
                .properties(Maps.builder()
                        .put("prop1", "CUSTOM_PARAM_VALUE")
                        .put("prop2", true)
                        .put("prop3", 3)
                        .build())
                .timestamp(new Date())
                .build();
    } catch (SecureNativeInvalidOptionsException e) {
        e.printStackTrace();
    }

    VerifyResult verifyResult = null;
    try {
        verifyResult = securenative.verify(eventOptions);
    } catch (SecureNativeInvalidOptionsException e) {
        e.printStackTrace();
    }    

    verifyResult.getRiskLevel(); // Low, Medium, High
    verifyResult.getScore(); // Risk score: 0 -1 (0 - Very Low, 1 - Very High)
    verifyResult.getTriggers(); // ["TOR", "New IP", "New City"]
}

Webhook signature verification

Apply our filter to verify the request is from us, example in spring:

@RequestMapping("/webhook")
public void webhookEndpoint(HttpServletRequest request, HttpServletResponse response) {
    SecureNative securenative = null;
    try {
        securenative = SecureNative.getInstance();
    } catch (SecureNativeSDKIllegalStateException e) {
        System.err.printf("Could not get SecureNative instance; %s%n", e);
    }
    
    // Checks if request is verified
    Boolean isVerified = securenative.verifyRequestPayload(request);
}

Extract proxy headers from cloud providers

You can specify custom header keys to allow extraction of client ip from different providers. This example demonstrates the usage of proxy headers for ip extraction from Cloudflare.

Option 1: Using config file

SECURENATIVE_API_KEY="YOUR_API_KEY"
SECURENATIVE_PROXY_HEADERS=["CF-Connecting-IP"]

Initialize sdk as shown above.

Options 2: Using ConfigurationBuilder

try {
    securenative = SecureNative.init(SecureNative.configBuilder()
        .withApiKey("API_KEY")
        .WithProxyHeaders(new ["CF-Connecting-IP"])
        .build());
} catch (SecureNativeSDKException e) {
    e.printStackTrace();
}

Remove PII Data From Headers

By default, SecureNative SDK remove any known pii headers from the received request. We also support using custom pii headers and regex matching via configuration, for example:

Option 1: Using config file

SECURENATIVE_API_KEY="YOUR_API_KEY"
SECURENATIVE_PII_HEADERS=["apiKey"]

Initialize sdk as shown above.

Options 2: Using ConfigurationBuilder

try {
    securenative = SecureNative.init(SecureNative.configBuilder()
        .withApiKey("API_KEY")
        .WithPiiRegexPattern("((?i)(http_auth_)(\\w+)?)")
        .build());
} catch (SecureNativeSDKException e) {
    e.printStackTrace();
}
com.securenative.java

SecureNative

A Cloud-Native Security Monitoring and Protection Platform

Versions

Version
0.3.0
0.2.3
0.2.2
0.2.1
0.2.0