Gateway mode

VERISCO sits in front of your application. Your DNS points at us and we reverse-proxy to an address we can reach.

When to use it#

Your application is already reachable from where VERISCO runs. It can be written in any language: it reads one header.

What you give us#

Your hostname	The public name your users type. Its DNS record points at VERISCO, which obtains and renews the TLS certificate.
Your backend address	`host:port`, for example `10.0.0.5:8080`. It has to be an address VERISCO itself can open a connection to.

You do not need a sign-in client id or secret in this mode. VERISCO performs the whole exchange.

What your application does#

Download your public key

Shell

verisco-analyzer download-key --api-key <your analyzer key>

Verify the signed identity on each request

On Node, mount the middleware:

JavaScript

const { verisco, protect } = require('@verisco/verisco-middleware');

// Mount before your routes. Populates req.user from the
// verisco_session cookie, verified with your RS256 public key.
app.use(verisco({ publicKeyFile: './config/verisco_public.pem' }));

// Require a signed-in user on a route:
app.get('/dashboard', protect(), (req, res) => res.json(req.user));

On anything else, verify the X-Verisco-Claims header. See Read the signed-in user.

Point your sign-out link at VERISCO
html
```
<a href="/verisco/logout">Sign out</a>
```
Remove your own login

Once you go live, nobody reaches your application without a VERISCO session.

Paths VERISCO serves on your hostname#

Path	Purpose
`/verisco/login`	Starts a sign-in. Accepts `returnTo`, the path to come back to.
`/verisco/callback`	Where the sign-in page returns. You never link to it.
`/verisco/logout`	Ends the session and signs the user out.
`/verisco/me`	The user's own page: their sessions and devices, and setting up a device.

Do not define routes under /verisco/ in your application. The gateway answers them before your code is reached.

Paths you can exempt#

Set in your console, applied by the gateway before your application is reached:

Setting	Effect
Public paths	Served without a session: a landing page, a status page, static assets.
Health check path	Exactly one path let through without a session, for your load balancer or uptime monitor.
Sealed paths	Return 404 at the gateway. Use it for your old login page, so it is unreachable from outside.

What is enforced, and where#

Every control is applied before the request reaches your code: session lifetime and idle time, revocation, session binding and device re-checks. Nothing you deploy can switch it off. Ending a session takes effect within 5 seconds.

Something missing or wrong on this page? Tell us and we will fix it.