You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/security.mdx
+32-4Lines changed: 32 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,9 +17,11 @@ There are 2 security-related features available:
17
17
18
18
## Custom nonce
19
19
20
+
_Currently available only in version 21.x of the package_.
21
+
20
22
[Nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce) (number used once) is a security measure used to mitigate replay attacks and to associate a Client session with an ID Token.
21
23
22
-
The authorization APIs in [Universal Sign-In](/docs/one-tap) for Apple, Android and web allow you to specify a nonce.
24
+
The authorization APIs in [Universal Sign-In](/docs/one-tap) for Apple, Android and web allow you to specify nonce.
23
25
24
26
Example usage:
25
27
@@ -36,8 +38,8 @@ import TabItem from '@theme/TabItem';
36
38
37
39
[//]: #'or use uuid v4 with react-native-get-random-values or expo-crypto'
38
40
39
-
<Tabs>
40
-
<TabItemvalue="expo-crypto"label="expo-crypto">
41
+
<TabsqueryString="expo-or-community">
42
+
<TabItemvalue="expo"label="expo-crypto">
41
43
42
44
```ts
43
45
import*asCryptofrom'expo-crypto';
@@ -57,7 +59,7 @@ export function getUrlSafeNonce(byteLength = 32) {
@@ -82,6 +84,9 @@ export function getUrlSafeNonce(byteLength = 32) {
82
84
83
85
Auth providers such as [Supabase](https://supabase.com/docs/reference/javascript/auth-signinwithidtoken) require passing SHA-256 hash (digest) of the nonce ([source](https://github.com/supabase/auth-js/blob/dfb40d24188f7e8b0d34e51ded15582086250c51/src/lib/types.ts#L612)). This can be done as follows:
App Check helps protect your apps from abuse by preventing unauthorized clients from authenticating using Google Sign-in: only the apps you've authorized can acquire access tokens and ID tokens from Google's OAuth 2.0 and OpenID Connect endpoint.
0 commit comments