Lesson 9. Authorization of requests to the mini-application server

The main thing in the lesson

•

The client side of the mini-application runs in iframe or WebView and interacts with the server side. Request authorization is a procedure that the server performs for each request to ensure that it comes from a trusted source.
•

Authorization is used mini-application startup parameters . You can get them in the client side of the mini-app when you start from the property window.location.search or at any time thereafter by an event VKWebAppGetLaunchParams .
•
A possible verification algorithm looks like this:
- •
  
  In the client side of the mini-application, encode a string with startup parameters in base64 format and include the resulting value in the request header that is sent to the server.
- •
  
  When the request is received, the server will extract this value and calculate the signature of the startup parameters according to the established algorithm. Then it compares the value with the parameter sign which is part of the transmitted string. Values should be equal. The difference means possible data substitution.
•

The signature calculation algorithm uses the protected key from the settings of the mini-application, which is known to you, the developer of the mini-application, and is not available to third parties.
•

Startup setting vk_ts It contains information about the time of signature creation. If the signature was generated more than an hour ago, we recommend not to process the request, but to request new data from the client part.

:::