Relock Cloud

Relock is an advanced software cryptographic authenticator that allows you to add invisible strong factor of authentication to your applications. It provides an extra layer of security directly in the browser, without adding friction for your users. It covers all identities in a single roll-out and was designed to comply with strict regulatory requirements for AAL2/AAL3 and Strong Customer Authentication.

The system uses cryptographic one-time keys that are renewed and verified on demand, ensuring that every access and even every user interaction can be independently verified. It is scalable, efficient, and configurable for high availability, making it ideal for high assurance and uncompromised performance.

• Executive Summary
• Technical Overview
  • The State of Play
  • Bearer Session Model
  • Continuous Cryptographic Trust
  • Cryptographic Design
  • Continuous Access Evaluation (CAEP)
  • Relock System Properties
  • Core Technical Characteristics
  • Client-Side Secret Storage
  • Security Assurance Under Fatal Compromise
  • Method Comparison
  • Regulatory Alignment
  • Compliance Matrix
  • Technical Summary
• Deployment Options
  • Prerequisites
  • Redirect-Based Integration (Login-level)
    • Simple Deployment (Third-party cloud)
    • SameSite Deployment
  • JavaScript Agent Integration (Request-level)
  • Brief Summary
• Simple Integration
  • Use Case Example
  • New Cloud Relock Gateway
  • Web Application Changes
  • Authentication Flow
  • Response Verification
  • Verifying gateway signature
  • Notes and Best Practices
• SameSite Integration
  • Gateway Wildcard Header
    • Redirect Routes Note
  • Reverse-proxy configuration
  • SameSite Login Hook
• JavaScript Agent Integration
  • Reverse Proxy Setup (Required)
  • HTTP Strict Transport Security (HSTS)
  • Relock.js Library Integration
  • Content Security Policy (CSP) with Nonces
    • Recommended CSP (header)
    • Authorizing relock.js with the nonce
    • Generating the nonce (server examples)
    • SPA considerations
    • Subresource Integrity (SRI)
    • Common pitfalls checklist
    • Why this matters
  • Subresource Integrity (SRI)
  • MPA Web Applications
  • Multi-Tab Browsing Support
  • SPA Web Applications
  • Key Established Event
  • Established Event Payload
  • Backend-Side Request Verification
  • Basic Request Authentication
  • Critical Request Authentication
  • Relock Gateway Status Codes
  • Login and Logout a User in the Gateway
  • Zero-Trust Remember-Me
  • Best Practices for Secure Deployment