Origin verification

Connection valuesCopy Anchor Link

Copy the issuer, public key URL, and application audience from Zero Trust > Origin verification. Keep these values in trusted application configuration.

Required checksCopy Anchor Link

1. Verify the RS256 signature with the configured public keys.
2. Verify the issuer, audience, expiry, and not-before time.
3. Compare host with the configured public hostname.
4. Compare method and origin_uri with the origin request.
5. Read identity claims only after verification.

Reject requests with missing or invalid assertions. Email claims require email_verified: true. Use the immutable subject as the application account identifier.

Application exampleCopy Anchor Link

Download the Go verifier and its module file into a new directory. Run go mod tidy in that directory.

LOCLIX_ACCESS_ISSUER=https://private.example.com/_loclix/access/ \
LOCLIX_ACCESS_AUDIENCE=APPLICATION-ID \
go run .

Run the example behind an HTTPS reverse proxy with a trusted certificate. It listens on localhost. Apply the same verification to each protected route in your application. Keep your application's authorization and cross-site request forgery protections.

Connection protectionCopy Anchor Link

Assertions expire after 60 seconds and can be replayed for the same request within that time. Restrict direct origin access as well as verifying the token. Use verified HTTPS and a firewall or authenticated origin pulls.

Headers and claims reference