How to implement apple token based push notifications (using p8 file) in C#?

Question

For an app with some kind of chat based features I want to add push notification support for receiving new messages. What I want to do is use the new token based authenticat

Answer 1

I has a problem like you. And i seen @gorniv answer. So it's work with me!

May be you can use: https://www.nuget.org/packages/Apple.Auth.Signin for it!

Goodluck!

Answer 2

You can't really do this on raw .NET Framework at the moment. The new JWT-based APNS server uses HTTP/2 only, which .NET Framework does not yet support.

.NET Core's version of System.Net.Http, however, does, provided you meet the following prerequisites:

• On Windows, you must be running Windows 10 Anniversary Edition (v1607) or higher, or the equivalent build of Windows Server 2016 (I think).
• On Linux, you must have a version of libcurl that supports HTTP/2.
• On macOS, you have to compile libcurl with support for HTTP/2, then use the DYLD_INSERT_LIBRARIES environment variable in order to load your custom build of libcurl.

You should be able to use .NET Core's version of System.Net.Http in the .NET Framework if you really want.

I have no idea what happens on Mono, Xamarin or UWP.

There are then three things you have to do:

1. Parse the private key that you have been given. This is currently an ECDSA key, and you can load this into a System.Security.Cryptography.ECDsa object.

• On Windows, you can use the CNG APIs. After parsing the base64-encoded DER part of the key file, you can then create a key with new ECDsaCng(CngKey.Import(data, CngKeyBlobFormat.Pkcs8PrivateBlob)).
• On macOS or Linux there is no supported API and you have to parse the DER structure yourself, or use a third-party library.

2. Create a JSON Web Token / Bearer Token. If you use the System.IdentityModel.Tokens.Jwt package from NuGet, this is fairly simple. You will need the Key ID and Team ID from Apple.

public static string CreateToken(ECDsa key, string keyID, string teamID)
{
    var securityKey = new ECDsaSecurityKey(key) { KeyId = keyID };
    var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.EcdsaSha256);

    var descriptor = new SecurityTokenDescriptor
    {
          IssuedAt = DateTime.Now,
          Issuer = teamID,
          SigningCredentials = credentials
    };

    var handler = new JwtSecurityTokenHandler();
    var encodedToken = handler.CreateEncodedJwt(descriptor);
    return encodedToken;
}

3. Send an HTTP/2 request. This is as normal, but you need to do two extra things:
4. Set yourRequestMessage.Version to new Version(2, 0) in order to make the request using HTTP/2.
5. Set yourRequestMessage.Headers.Authorization to new AuthenticationHeaderValue("bearer", token) in order to provide the bearer authentication token / JWT with your request.

Then just put your JSON into the HTTP request and POST it to the correct URL.

Answer 3

private string GetToken()
    {
        var dsa = GetECDsa();
        return CreateJwt(dsa, "keyId", "teamId");
    }
    
    private ECDsa GetECDsa()
    {
        using (TextReader reader = System.IO.File.OpenText("AuthKey_xxxxxxx.p8"))
        {
        var ecPrivateKeyParameters =
            (ECPrivateKeyParameters)new Org.BouncyCastle.OpenSsl.PemReader(reader).ReadObject();

        var q = ecPrivateKeyParameters.Parameters.G.Multiply(ecPrivateKeyParameters.D).Normalize();
        var qx = q.AffineXCoord.GetEncoded();
        var qy = q.AffineYCoord.GetEncoded();
        var d = ecPrivateKeyParameters.D.ToByteArrayUnsigned();

        // Convert the BouncyCastle key to a Native Key.
        var msEcp = new ECParameters {Curve = ECCurve.NamedCurves.nistP256, Q = {X = qx, Y = qy}, D = d};
        return ECDsa.Create(msEcp);
        }
    }
    
    private string CreateJwt(ECDsa key, string keyId, string teamId)
    {
        var securityKey = new ECDsaSecurityKey(key) { KeyId = keyId };
        var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.EcdsaSha256);

        var descriptor = new SecurityTokenDescriptor
        {
            IssuedAt = DateTime.Now,
            Issuer = teamId,
            SigningCredentials = credentials,
            
        };

        var handler = new JwtSecurityTokenHandler();
        var encodedToken = handler.CreateEncodedJwt(descriptor);
        return encodedToken;
    }

Answer 4

Because Token (.p8) APNs only works in HTTP/2, thus most of the solutions only work in .net Core. Since my project is using .net Framework, some tweak is needed. If you're using .net Framework like me, please read on.

I search here and there and encountered several issues, which I managed to fix and pieced them together.

Below is the APNs class that actually works. I created a new class library for it, and placed the .P8 files within the AuthKeys folder of the class library. REMEMBER to right click on the .P8 files and set it to "Always Copy". Refer Get relative file path in a class library project that is being referenced by a web project.

After that, to get the location of the P8 files, please use AppDomain.CurrentDomain.RelativeSearchPath for web project or AppDomain.CurrentDomain.BaseDirectory for win application. Refer Why AppDomain.CurrentDomain.BaseDirectory not contains "bin" in asp.net app?

To get the token from the P8, you'll need to use the BouncyCastle class, please download it from Nuget.

using Jose;
using Newtonsoft.Json;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.OpenSsl;
using Security.Cryptography;
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

    namespace PushLibrary
    {
        public class ApplePushNotificationPush
        {
            //private const string WEB_ADDRESS = "https://api.sandbox.push.apple.com:443/3/device/{0}";
            private const string WEB_ADDRESS = "https://api.push.apple.com:443/3/device/{0}";
    
            private string P8_PATH = AppDomain.CurrentDomain.RelativeSearchPath + @"\AuthKeys\APNs_AuthKey.p8";
    
            public ApplePushNotificationPush()
            {
    
            }
    
            public async Task<bool> SendNotification(string deviceToken, string title, string content, int badge = 0, List<Tuple<string, string>> parameters = null)
            {
                bool success = true;
    
                try
                {
                    string data = System.IO.File.ReadAllText(P8_PATH);
                    List<string> list = data.Split('\n').ToList();
    
                    parameters = parameters ?? new List<Tuple<string, string>>();
    
                    string prk = list.Where((s, i) => i != 0 && i != list.Count - 1).Aggregate((agg, s) => agg + s);
                    ECDsaCng key = new ECDsaCng(CngKey.Import(Convert.FromBase64String(prk), CngKeyBlobFormat.Pkcs8PrivateBlob));
    
                    string token = GetProviderToken();
    
                    string url = string.Format(WEB_ADDRESS, deviceToken);
                    HttpRequestMessage httpRequestMessage = new HttpRequestMessage(HttpMethod.Post, url);
    
                    httpRequestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
    
                    httpRequestMessage.Headers.TryAddWithoutValidation("apns-push-type", "alert"); // or background
                    httpRequestMessage.Headers.TryAddWithoutValidation("apns-id", Guid.NewGuid().ToString("D"));
                    //Expiry
                    //
                    httpRequestMessage.Headers.TryAddWithoutValidation("apns-expiration", Convert.ToString(0));
                    //Send imediately
                    httpRequestMessage.Headers.TryAddWithoutValidation("apns-priority", Convert.ToString(10));
                    //App Bundle
                    httpRequestMessage.Headers.TryAddWithoutValidation("apns-topic", "com.xxx.yyy");
                    //Category
                    httpRequestMessage.Headers.TryAddWithoutValidation("apns-collapse-id", "test");
    
                    //
                    var body = JsonConvert.SerializeObject(new
                    {
                        aps = new
                        {
                            alert = new
                            {
                                title = title,
                                body = content,
                                time = DateTime.Now.ToString()
                            },
                            badge = 1,
                            sound = "default"
                        },
                        acme2 = new string[] { "bang", "whiz" }
                    });
    
                    httpRequestMessage.Version = new Version(2, 0);
    
                    using (var stringContent = new StringContent(body, Encoding.UTF8, "application/json"))
                    {
                        //Set Body
                        httpRequestMessage.Content = stringContent;
    
                        Http2Handler.Http2CustomHandler handler = new Http2Handler.Http2CustomHandler();
    
                        handler.SslProtocols = System.Security.Authentication.SslProtocols.Tls12 | System.Security.Authentication.SslProtocols.Tls11 | System.Security.Authentication.SslProtocols.Tls;
    
                        //handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true;
    
                        //Continue
                        using (HttpClient client = new HttpClient(handler))
                        {
                            HttpResponseMessage resp = await client.SendAsync(httpRequestMessage).ContinueWith(responseTask =>
                            {
                                return responseTask.Result;
                            });
    
                            if (resp != null)
                            {
                                string apnsResponseString = await resp.Content.ReadAsStringAsync();
    
                                handler.Dispose();
                            }
    
                            handler.Dispose();
                        }
                    }
                }
                catch (Exception ex)
                {
                    success = false;
                }
    
                return success;
            }
    
            private string GetProviderToken()
            {
                double epochNow = (int)DateTime.UtcNow.Subtract(new DateTime(1970, 1, 1)).TotalSeconds;
                Dictionary<string, object> payload = new Dictionary<string, object>()
                {
                    { "iss", "YOUR APPLE TEAM ID" },
                    { "iat", epochNow }
                };
                var extraHeaders = new Dictionary<string, object>()
                {
                    { "kid", "YOUR AUTH KEY ID" },
                    { "alg", "ES256" }
                };
    
                CngKey privateKey = GetPrivateKey();
    
                return JWT.Encode(payload, privateKey, JwsAlgorithm.ES256, extraHeaders);
            }
    
            private CngKey GetPrivateKey()
            {
                using (var reader = File.OpenText(P8_PATH))
                {
                    ECPrivateKeyParameters ecPrivateKeyParameters = (ECPrivateKeyParameters)new PemReader(reader).ReadObject();
    
                    var x = ecPrivateKeyParameters.Parameters.G.AffineXCoord.GetEncoded();
                    var y = ecPrivateKeyParameters.Parameters.G.AffineYCoord.GetEncoded();
    
                    var d = ecPrivateKeyParameters.D.ToByteArrayUnsigned();
    
                    return EccKey.New(x, y, d);
                }
            }
        }
    }

Secondly, if you noticed, I am using the custom WinHTTPHandler to make the code to support HTTP/2 based on How to make the .net HttpClient use http 2.0?. I am creating this using another class library, remember to download WinHTTPHandler from Nuget.

    public class Http2CustomHandler : WinHttpHandler
    {
        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, System.Threading.CancellationToken cancellationToken)
        {
            request.Version = new Version("2.0");

            return base.SendAsync(request, cancellationToken);
        }
    }

After that, just call the "SendNotification" on the ApplePushNotificationPush class and you should get the message on your iPhone.

Answer 5

It have tried the above on ASP.NET CORE 2.1 and 2.2 to no avail. The response I always got was "The message received was unexpected or badly formatted" with HttpVersion20 enabled, which made me doubt whether http2 implementation is concrete.

Below is what worked on ASP.NET CORE 3.0;

 var teamId = "YOURTEAMID";
 var keyId = "YOURKEYID";

            try
            {
                //
                var data = await System.IO.File.ReadAllTextAsync(Path.Combine(_environment.ContentRootPath, "apns/"+config.P8FileName));
                var list = data.Split('\n').ToList();
                var prk = list.Where((s, i) => i != 0 && i != list.Count - 1).Aggregate((agg, s) => agg + s);
                //
                var key = new ECDsaCng(CngKey.Import(Convert.FromBase64String(prk), CngKeyBlobFormat.Pkcs8PrivateBlob));
                //
                var token = CreateToken(key, keyId, teamId);
                //
                var deviceToken = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX";
                var url = string.Format("https://api.sandbox.push.apple.com/3/device/{0}", deviceToken);
                var request = new HttpRequestMessage(HttpMethod.Post, url);
                //
                request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
                //

                request.Headers.TryAddWithoutValidation("apns-push-type", "alert"); // or background
                request.Headers.TryAddWithoutValidation("apns-id", Guid.NewGuid().ToString("D"));
                //Expiry
                //
                request.Headers.TryAddWithoutValidation("apns-expiration", Convert.ToString(0));
                //Send imediately
                request.Headers.TryAddWithoutValidation("apns-priority", Convert.ToString(10));
                //App Bundle
                request.Headers.TryAddWithoutValidation("apns-topic", "com.xx.yy");
                //Category
                request.Headers.TryAddWithoutValidation("apns-collapse-id", "test");

                //
                var body = JsonConvert.SerializeObject(new
                {
                    aps = new
                    {
                        alert = new
                        {
                            title = "Test",
                            body = "Sample Test APNS",
                            time = DateTime.Now.ToString()
                        },
                        badge = 1,
                        sound = "default"
                    },
                    acme2 = new string[] { "bang", "whiz" }
                })
                //
                request.Version = HttpVersion.Version20;
                //
                using (var stringContent = new StringContent(body, Encoding.UTF8, "application/json"))
                {
                    //Set Body
                    request.Content = stringContent;
                    _logger.LogInformation(request.ToString());
                    //
                    var handler = new HttpClientHandler();
                    //
                    handler.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls;
                    //
                    handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true;

                    //Continue
                    using (HttpClient client = new HttpClient(handler))
                    {
                        //
                        HttpResponseMessage resp = await client.SendAsync(request).ContinueWith(responseTask =>
                        {
                            return responseTask.Result;
                            //

                        });
                        //
                        _logger.LogInformation(resp.ToString());
                        //
                        if (resp != null)
                        {
                            string apnsResponseString = await resp.Content.ReadAsStringAsync();
                            //
                            handler.Dispose();
                            //ALL GOOD ....
                            return;
                        }
                        //
                        handler.Dispose();
                    }
                }
            }
            catch (HttpRequestException e)
            {
                _logger.LogError(5, e.StackTrace, e);
            }

For CreateToken() Refer Above Recommended solution by yaakov,

Answer 6

You can use PushSharp which is a nuget package which support push notification for Apple and also for Google and Microsoft.

Here are the links to github and nuget.

This is a sample to send push notification for Apple:

// Configuration (NOTE: .pfx can also be used here)
var config = new ApnsConfiguration (ApnsConfiguration.ApnsServerEnvironment.Sandbox, 
"push-cert.p12", "push-cert-pwd");

// Create a new broker
var apnsBroker = new ApnsServiceBroker (config);

// Wire up events
apnsBroker.OnNotificationFailed += (notification, aggregateEx) => {

aggregateEx.Handle (ex => {

    // See what kind of exception it was to further diagnose
    if (ex is ApnsNotificationException) {
        var notificationException = (ApnsNotificationException)ex;

        // Deal with the failed notification
        var apnsNotification = notificationException.Notification;
        var statusCode = notificationException.ErrorStatusCode;

        Console.WriteLine ($"Apple Notification Failed: ID={apnsNotification.Identifier}, Code={statusCode}");

    } else {
        // Inner exception might hold more useful information like an ApnsConnectionException           
        Console.WriteLine ($"Apple Notification Failed for some unknown reason : {ex.InnerException}");
    }

        // Mark it as handled
        return true;
    });
};

    apnsBroker.OnNotificationSucceeded += (notification) => {
    Console.WriteLine ("Apple Notification Sent!");
};

// Start the broker
apnsBroker.Start ();

foreach (var deviceToken in MY_DEVICE_TOKENS) {
// Queue a notification to send
apnsBroker.QueueNotification (new ApnsNotification {
    DeviceToken = deviceToken,
    Payload = JObject.Parse ("{\"aps\":{\"badge\":7}}")
    });
}

// Stop the broker, wait for it to finish   
// This isn't done after every message, but after you're
// done with the broker
apnsBroker.Stop ();