Kameleoon application file integrity - Kameleoon Documentation

Introduction

The Automation API lets you verify the integrity of the Kameleoon application file loaded on your website, confirming that it hasn’t changed and is safe to use on your site. The integrity verification process generates a hash code from the contents of the application file, then compares it to the hash code of the file your website loads. Both hash codes must match every time. This document guides you through implementing this health check, which keeps the application file secure from tampering.

The API generates only a hashCode. Decide how to use the generated hash to secure the Kameleoon application file.

Sample implementation of the integrity check

To obtain the hash code of the original Kameleoon application file, call the Automation API. First, gain access to the Automation API using OAuth 2.0 and reference the relevant documentation. As shown in the example below, after you make a request to the API endpoint to retrieve the hash code, compare it with the hash code you calculate on your end to confirm no one has tampered with the file.

const axios = require("axios");
const crypto = require("crypto");

const API_SSX_URL = "https://api.kameleoon.com";
const SITE_CODE = "SITE_CODE";
const HASH_TYPE = "SHA256";
const CLIENT_ID = "CLIENT_ID";
const CLIENT_SECRET = "CLIENT_SECRET";

async function obtainAuthToken() {
	const response = await axios({
		url: `${API_SSX_URL}/oauth/token`,
		method: "POST",
		headers: {
			"Content-type": "application/x-www-form-urlencoded"
		},
		data: `grant_type=client_credentials&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}`
	});
	return response.data.access_token;
}

async function obtainHash() {
	const token = await obtainAuthToken();
	const hashCodeResponse = await axios({
		url: `${API_SSX_URL}/sites/${SITE_CODE}/hash`,
		method: "PATCH",
		headers: {
			Authorization: "Bearer " + token,
			"Content-type": "application/json"
		},
		data: `{"hashType": "${HASH_TYPE}"}`
	});

	return hashCodeResponse.data.hashCode; //  { hashCode: 'hashCode', hashType: "SHA256" }
}

// function to compare the hash code

	async function checkHash() {
	const scriptResponse = await axios({
		url: `https://${SITE_CODE}.kameleoon.io/engine.js?t=${new Date().getTime()}`,
		method: "GET"
	});
	const hashCodeFromAPI = await obtainHash();
	const hashCode = crypto.createHash(HASH_TYPE).update(scriptResponse.data).digest("hex");
	return hashCodeFromAPI === hashCode;
}

checkHash();

<?php

$API_SSX_URL = 'https://api.kameleoon.com';
$SITE_CODE = 'SITE_CODE';
$HASH_TYPE = 'SHA256';
$CLIENT_ID = 'CLIENT_ID';
$CLIENT_SECRET = 'CLIENT_SECRET';

$tokenRequest = curl_init($API_SSX_URL . "/oauth/token");
curl_setopt($tokenRequest, CURLOPT_POST, 1);
curl_setopt($tokenRequest, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($tokenRequest, CURLOPT_POSTFIELDS, "grant_type=client_credentials&client_id=" . $CLIENT_ID . "&client_secret=" . $CLIENT_SECRET);
$tokenOutput = curl_exec($tokenRequest);
curl_close($tokenRequest);
$token = json_decode($tokenOutput)->access_token;

$hashRequest = curl_init($API_SSX_URL . "/sites/" . $SITE_CODE . "/hash");
curl_setopt($hashRequest, CURLOPT_CUSTOMREQUEST, 'PATCH');
curl_setopt($hashRequest, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($hashRequest, CURLOPT_POSTFIELDS, json_encode(array(
  'hashType' => $HASH_TYPE
)));
curl_setopt($hashRequest, CURLOPT_HTTPHEADER, array(
  'Content-Type: application/json',
  'Authorization: Bearer ' . $token
));
$hashOutput = curl_exec($hashRequest);
curl_close($hashRequest);
$hash = json_decode($hashRequest)->hashCode;

// Some method to compare the hash code
checkHash($hash);

Kameleoon doesn’t continuously verify the application files hosted on its CDN for each customer. Instead, you determine how to verify the application files and which actions to take if hash codes mismatch, based on your specific requirements. As a safe practice, promptly remove the application file link from your website if you detect a mismatch.

The domain for your Kameleoon scripts may differ between projects. Depending on when you created your projects, they may use either kameleoon.eu or kameleoon.io. Use the domain that appears in your project within the Kameleoon App.

​Introduction

​Sample implementation of the integrity check

Introduction

Sample implementation of the integrity check