VERISCO Shield Onboard
Going live
A published tenant starts in pass-through, where nobody is blocked. You turn protection on when your code is ready, and you can turn it back off in seconds.
Pass-through#
From the moment your tenant is published, your hostname goes through VERISCO. In pass-through:
- a request with a VERISCO session is forwarded with the signed identity;
- a request without one is forwarded anyway;
- your own login page keeps working.
So you can add the middleware, deploy, and test with real traffic, in any order, without breaking your site.
While you are in pass-through, your integration status shows Protection switched on as a warning and your old login as reachable. Both are expected until you go live.
Verify#
verisco-analyzer verify --api-key <your analyzer key>Verify answers two different questions and labels them separately:
| Check | Who runs it | What it proves |
|---|---|---|
| Local | The CLI, on your machine | The middleware is mounted and your public key file is readable. Reported as a self-report. |
| From outside | The platform | A request to your hostname reaches your application through VERISCO, and a session produces a valid identity. |
The result appears on your integration page in the console, check by check, each with the next thing to do when it fails.
| Checked on your machine | Checked from outside |
|---|---|
| The middleware is mounted | Your hostname's DNS points at VERISCO |
| Your public key file is readable | Your health path answers |
| The session cookie's name is the expected one | The gateway routes to your application |
| Your routes require a signed-in user | Your public paths are served without a session |
| Your old login | Your old login is sealed |
| Your backend cannot be reached directly, around VERISCO | |
| In connector mode: the agent is connected |
Go live#
verisco-analyzer go-live --api-key <your analyzer key>Or press Go live in your console. Within about five seconds every request goes through VERISCO sign-in.
Go-live is refused until verify is green
VERISCO will not turn protection on until verify has confirmed both the middleware and your public key, and it says which one is missing. This is deliberate: going live before your application reads the signed identity signs everyone in and then shows them nothing.
Go back#
verisco-analyzer go-back --api-key <your analyzer key>Returns to pass-through just as fast. It is never refused.
After going live#
Remove or seal your application's own login and sign-up routes. They are no longer how anyone gets in, and leaving them reachable leaves a second door. Your console can seal a path so the gateway returns 404 for it.
SDK mode#
SDK mode has no pass-through. Your application enforces by itself as soon as the middleware is mounted. See SDK mode.
Something missing or wrong on this page? Tell us and we will fix it.