This is a public Node.js Express server that hosts the API and website. It does all the client-facing non-VPN functionality like creating accounts, managing subscriptions, and hosting client certificates.

• Prerequisites
• Authentication
  • Sign In With Email/Password
  • Sign In With IAP Receipt
  • Log Out (Delete Session)
• Signup
  • IAP Signup
  • Email Signup - Web
  • Email Signup
  • Email Signup Success - Web
  • Confirm Email
  • Resend Confirmation Email - Web
  • Resend Confirmation Email
  • Add Email/Password to IAP-Created User
• Download App
  • Webpage With Links to Apps
  • Download Mac App
  • Download Mac Update
  • Download Windows App
  • Download Windows Update
• Get User Certificate/Key
• Account Management
  • Account - Web
  • Change Email - Web
  • Change Email
  • Change Password - Web
  • Change Password
  • Invoice History - Web
  • Get Invoice - Web
  • Payment Methods - Web
  • New Payment Method - Web
  • New Payment Method
  • Set Default Payment Method
  • Delete Payment Method
  • Email Opt Out - Web
  • Email Opt Out
• Reset Password
  • Request Reset Password - Web
  • Request Reset Password
  • Reset Password - Web
  • Reset Password
• Subscription Management
  • Get Subscriptions
  • Get Active Subscriptions
  • New Pro Subscription - Web
  • New Pro Subscription
  • Cancel Subscription - Web
  • Cancel Pro Subscription
• Diagnostic/Other APIs
  • Test Error Logging
  • Health Check
  • Get Current IP
  • Speed Test Bucket
• Error Responses
  • Response Format
  • Too Many Requests
  • Error Reference
• Support

• Run the Main CloudFormation and all its prerequisites
• Initialize the database with Admin Server
• Creating and setting a CURRENT_SOURCE_ID with Admin Server

Requires Authentication calls, require a session cookie from the POST /signin endpoint, which takes either email/password or IAP receipt. If you sign in with a new IAP receipt, a user will be created if that receipt has not been used before.

If a session cookie expires or server returns 401, request a new cookie with /signin.

Request

POST /signin 

Response

Set-Cookie: <Cookie with Expiration Time> 

If you sign in with a new IAP receipt, a user will be created if that receipt has not been used before.

Request

POST /signin 

Response

Set-Cookie: <Cookie with Expiration Time> 

Request

GET /logout 

Response

Redirects to /signin 

Doing a POST /signin with IAP receipt will automatically create a user. An IAP-Signup User is automatically assigned a certificate with source ID CURRENT_SOURCE_ID.

Request

GET /signup 

Request

POST /signup 

Response

Sends a confirmation email to the user to verify they own the email, with a link to /confirm-email.

If browser == true

Redirect to /signup-success

If browser == false

{code: 1, message: "Email Confirmation Sent" } 

Asks user to check their email for a confirmation link.

Request

GET /signup-success 

A user that confirmes their email is assigned a certificate with source ID CURRENT_SOURCE_ID.

Request

GET /confirm-email 

Response

Redirect to either /account or tunnels://emailconfirmed 

Request

GET /resend-confirm-code 

Request

POST /resend-confirm-code 

Response

Redirect to /signin 

Request

Authentication Required

POST /convert-shadow-user 

Response

Sends a confirmation email to the user to verify they own the email, with a link to /confirm-email.

{code: 1, message: "Email Confirmation Sent" } 

Request

GET /clients 

Request

GET /download-mac-app 

Response

Redirects to download the Mac app. If multiple versions are being distributed, the version that this redirects to will be selected randomly at percentages configured by the Admin Dashboard.

Request

GET /download-mac-update 

Response

Redirects to download the Mac update file. If multiple versions are being distributed, the version that this redirects to will be selected randomly at percentages configured by the Admin Dashboard.

Request

GET /download-mac-app 

Response

Redirects to download the Windows app. If multiple versions are being distributed, the version that this redirects to will be selected randomly at percentages configured by the Admin Dashboard.

Request

GET /download-windows-update 

Response

Redirects to download the Windows update file. If multiple versions are being distributed, the version that this redirects to will be selected randomly at percentages configured by the Admin Dashboard.

Request

Authentication Required

POST /get-key 

Response

{id: <User ID>, b64: Base64 encoded client certificate } 

Request

Authentication Required

GET /account 

Request

Authentication Required

Returns CSRF Token

GET /change-email 

Request

Authentication Required

CSRF Token Required

POST /change-email 

Response

Redirect to /account Sends email to confirm 

Request

Authentication Required

Returns CSRF Token

GET /change-password 

Request

Authentication Required

CSRF Token Required

POST /change-password 

Response

Redirect to /account 

Request

Authentication Required

GET /invoices 

Request

Authentication Required

GET /invoices 

Request

Authentication Required

GET /payment-methods 

Request

Authentication Required

GET /add-new-card 

Request

Authentication Required

POST /add-new-card 

Response

Redirect to /payment-methods 

Request

Authentication Required

POST /set-default-card 

Response

{message: "New default set successfully" } 

Request

Authentication Required

POST /delete-card 

Response

{message: "Card deleted successfully" } 

Links to opt out of email are automatically generated on every email sent to users, and placed at the bottom of every email. Authentication is not required to opt-out of emails, because someone may receive

Request

GET /do-not-email 

Request

POST /do-not-email 

Response

Redirect to /sign-in with success message 

Request

GET /forgot-password 

Request

POST /forgot-password 

Response

Sends a password request email if it exists.

Redirect to /signin 

Request

GET /reset-password 

Request

POST /reset-password 

Response

Redirect to /signin 

Request

Authentication Required

POST /subscriptions 

Response

[{"planType": "all-monthly", "receiptId": "GPA.3353-4716-1949-52255", "expirationDate": "2018-03-10T07:14:06.065Z", "expirationDateString": "March 10, 2018", "expirationDateMs": 1520666046.065, "cancellationDate": null, "cancellationDateString": null, "cancellationDateMs": null, "userId": "a25b8f5640106f9e9a4990e592a3dc4e", "receiptType": "android", "inTrial": false, "renewEnabled": true } ] 

Request

Authentication Required

POST /active-subscriptions 

Response

[{"planType": "all-monthly", "receiptId": "GPA.3353-4716-1949-52255", "expirationDate": "2018-03-10T07:14:06.065Z", "expirationDateString": "March 10, 2018", "expirationDateMs": 1520666046.065, "cancellationDate": null, "cancellationDateString": null, "cancellationDateMs": null, "userId": "a25b8f5640106f9e9a4990e592a3dc4e", "receiptType": "android", "inTrial": false, "renewEnabled": true } ] 

This is used by both browser and Mac/PC clients in a webview to create a new Pro subscription via Stripe. Creating subscriptions on iOS/Android clients don't use this because that's handled by iTunes and Google Play.

Request

Authentication Required

GET /new-subscription 

Response

If user already has an active Pro subscription

Redirect to /account with "You already have a Pro subscription" 

If user doesn't have an active Pro subscription

Render new subscription page using locale and existing payment methods, if any. 

Request

Authentication Required

POST /new-subscription 

Response

If upgrade specified

Redirect to /account with message: Be sure to cancel your iOS/Android-only subscription with Apple iTunes/Google Play 

Else if browser == true

Redirect to /clients 

Else

Redirect to tunnels://stripesuccess 

Request

Authentication Required

GET /cancel-subscription 

Response

If receiptType == ios/android

Redirect to /account with message: Subscriptions made through the iOS/Android app must be cancelled through Apple/Google Play 

Else

Render cancel-subscription view with receiptId 

Request

Authentication Required

POST /cancel-subscription 

Response

Redirect to /account. 

Request

GET /error-test 

Request

GET /health 

Response

Status 200{message: "OK from www." + DOMAIN } 

Request

GET /ip 

Response

Status 200{ip: 12.34.56.78 } 

Request

GET /download-speed-test 

Response

Speed test files will be accessible by the following format, which allows for faster transfers: https://<bucket>.s3-accelerate.amazonaws.com/<filename>

Status 200{bucket: confirmedvpn-speedtest-bucket } 

Responses with status code 500 will show Unknown Error to user/client and will alert you by email at admin@[domain] or team@[domain].

2XX - Success with Message 4XX - Client Error 429 - Too Many Requests 5XX - Server Error 

JSON response with code (see Error Codes) and message. 500 status code errors are server errors which aren't exposed to the client and show a code of -1.

{code: 2, message: "Some error message, like Password Too Short" } 

If a client calls an API too frequently, the server will respond with status code 429 and a JSON body of:

{code: 999, message: "Too many requests in this time frame.", nextValidRequestDate: [Date of next valid request], nextValidRequestDateHuman: [Human readable date of next valid request] } 

If you have any questions, concerns, or other feedback, please let us know any feedback in Github issues or by e-mail.

We also have a bug bounty program -- please email engineering@confirmedvpn.com for details.

This project is licensed under the GPL License - see the LICENSE.md file for details

engineering@confirmedvpn.com