public final class HostPolicy
- Object
- HostPolicy
What the shield does for a given host: whether to attach an attestation token, whether to enforce certificate pins, and what to do when a token cannot be obtained.
Hosts are opt-in. A host with no policy registered gets UNPROTECTED and is left completely
alone – no header, no pin check, no possibility of a blocked request. That default is what
lets an existing app adopt the shield on its own API without disturbing its analytics, CDN,
map-tile or ad traffic.
Fields
public static final HostPolicy UNPROTECTED | The policy for any host the app did not explicitly register. |
public static final HostPolicy PROTECTED | Attach a token, enforce pins if the service has published any, and let the request through when no token is available. |
public static final HostPolicy ENFORCED | As PROTECTED but refuses to send the request without a valid token. |
Constructors
public HostPolicy(boolean attachToken, boolean enforcePins, FailureMode failureMode) |
Methods
public boolean isAttachToken() | True when requests to this host carry the attestation header. |
public boolean isEnforcePins() | True when the certificate chain for this host is checked against the published pin set. |
public FailureMode getFailureMode() | What to do when no token could be obtained. |
public boolean isNoOp() | True when this policy does nothing, so callers can skip work entirely. |
public String toString() | Returns a string representation of the object. |
Inherited methods
Field details
UNPROTECTED
public static final HostPolicy UNPROTECTEDThe policy for any host the app did not explicitly register. Does nothing at all.
PROTECTED
public static final HostPolicy PROTECTEDAttach a token, enforce pins if the service has published any, and let the request through
when no token is available. The sensible starting point for a protected host.
ENFORCED
public static final HostPolicy ENFORCEDConstructor details
HostPolicy
public HostPolicy(boolean attachToken, boolean enforcePins, FailureMode failureMode)Method details
isAttachToken
public boolean isAttachToken()True when requests to this host carry the attestation header.
isEnforcePins
public boolean isEnforcePins()True when the certificate chain for this host is checked against the published pin set.
Note that enforcement still only happens if a pin set for the host actually exists; see
PinSet for the never-brick rules.getFailureMode
public FailureMode getFailureMode()What to do when no token could be obtained.
isNoOp
public boolean isNoOp()True when this policy does nothing, so callers can skip work entirely.
toString
public String toString()Returns a string representation of the object. In general, the toString method returns a string that “textually represents” this object. The result should be a concise but informative representation that is easy for a person to read. It is recommended that all subclasses override this method.
The toString method for class Object returns a string consisting of the name of the class of which the object is an instance, the at-sign character `@’, and the unsigned hexadecimal representation of the hash code of the object. In other words, this method returns a string equal to the value of:
getClass().getName() + ‘@’ + Integer.toHexString(hashCode())