# Apple already shipped attestation on the web, and we barely noticed

DevFeed: [Apple already shipped attestation on the web, and we barely noticed](<https://devfeed.tech/articles/apple-already-shipped-attestation-on-the-web-and-we-barely-noticed-19041.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/apple-private-access-tokens-attestation/>)

Author: HTTP Toolkit; Tim Perry

Published: 2023-07-25T14:00:00Z

Content type: opinion

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Web](<https://devfeed.tech/topics/web.md>), [browser](<https://devfeed.tech/topics/browser.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [iOS](<https://devfeed.tech/topics/ios.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [Cloudflare](<https://devfeed.tech/topics/cloudflare.md>)

Tags: [apple](<https://devfeed.tech/tags/apple.md>), [attestation](<https://devfeed.tech/tags/attestation.md>), [browser](<https://devfeed.tech/tags/browser.md>), [browsers](<https://devfeed.tech/tags/browsers.md>), [chromium](<https://devfeed.tech/tags/chromium.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [http](<https://devfeed.tech/tags/http.md>), [ios](<https://devfeed.tech/tags/ios.md>), [macos](<https://devfeed.tech/tags/macos.md>), [public-key](<https://devfeed.tech/tags/public-key.md>), [server](<https://devfeed.tech/tags/server.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

This opinion article examines Apple's Private Access Tokens, an attestation system integrated into macOS 13, iOS 16, and Safari. It explains how browsers, operating systems, attesters, and token issuers use HTTP challenges and signed tokens to verify that requests come from legitimate devices without disclosing the user's identity, while comparing the system with the proposed Web Environment Integrity model.

## Source excerpt

There's been a lot of concern recently about the Web Environment Integrity proposal, developed by a selection of authors from Google, and apparently being prototyped in Chromium. There's good reason for anger here (though I'm not sure yelling at people on GitHub is necessarily the best outlet). This proposal amounts to attestation on the web, limiting access to features or entire sites based on whether the client is approved by a trusted issuer. In practice, that will mean Apple, Microsoft & Google. Of course, Google isn't the first to think of this, but in fact they're not even the first to ship it. Apple already developed & deployed an extremely similar system last year, now integrated into MacOS 13, iOS 16 & Safari, called "Private Access Tokens": Private Access Tokens are powerful tools that prove when HTTP requests are coming from legitimate devices without disclosing someone's identity. The focus here is primarily on removing captchas, and as such it's been integrated into Cloudflare (discussed here) and Fastly (here) as a mechanism for recognizing 'real' clients without needing other captcha mechanisms. Fundamentally though, it's exactly the same concept: a way that web servers can demand your device prove it is a sufficiently 'legitimate' device before browsing the web. How do Private Access Tokens work? The mechanism is a fairly simple exchange over HTTP, handled by built-in browser APIs, which in turn integrate with operating system components to confirm that the browser & OS are 'legitimate' (the exact definition of that is left to the attester - i.e. Apple). The flow looks like this: A browser makes an HTTP request from a web server. The web server refuses the request, and returns an HTTP 401 response with a PrivateToken challenge: HTTP/1.1 401 Unauthorized WWW-Authenticate: PrivateToken challenge=<base64 challenge data>, token-key=<base64 public-key> (Newlines added for readability) The browser recognizes this, and sends parts of the challenge, in addit