Quick tour - Gurgant/azurebank-v2 GitHub Wiki

A short walk through the live demo. You need a browser and nothing else. Most steps name the rule behind them and where that rule is written.

Before you start

  • Open the demo. The entry page starts the server and shows the wait, about 25 seconds when it was asleep.
  • It is a pretend bank and the money is invented. Do not enter real personal data.
  • I walked these steps in a Chromium browser, the engine of Chrome and Edge, on the demo as the repository's compose files run it on one machine. A full check in Safari and on an iPhone has not been done yet.

The walk

  1. Get a copy. On the entry page press Open the live demo. On the sign-in page that opens, press Try the demo. You get a private copy with two accounts, Main Savings with €12,450.00 and Checking with €2,300.00, two months of history and two contacts you can pay. The PIN is 123456, and the page shows it.

  2. Pay a contact. Open Transfer. Type the handle of a contact, without the at-sign, and press Verify: your contacts are named in the panel on the home page. Type an amount, press Review Transfer, then Continue, then type the PIN.

    The rule behind it: one PIN entry authorises one payment. The authorisation is bound to the account, the amount and the payee, is valid two minutes and is spent once. See ADR-0042.

  3. Double-click a deposit. Press Deposit, type 5, then double-click the button that sends it. You should see one deposit: the total goes up by €5.00, not €10.00.

    The rule behind it: the page sends one request, because the button is switched off while the request is being sent. The server does not rely on the page: every money move carries an idempotency key, an id the page makes once for that move, and a request that arrives twice with the same key is applied at most once. See ADR-0009 and the proof.

  4. Show a full account number. Open Accounts and press the eye button beside an account. The number stays masked until you type the PIN.

    The rule behind it: the number is masked by default, and the full number never appears in a list.

  5. Look in the browser's developer tools. The session cookie is HttpOnly, so a script cannot read it. Web storage holds no token and no session identifier. In demo mode one key, azurebank.demoCopy, holds what signs in to your throwaway copy; a second key appears once you choose a theme.

    The rule behind it: the JWT never reaches the browser. See ADR-0001.

  6. Make the window narrow, about 390 pixels wide. The home page, Accounts, History and Send Money should not scroll sideways, and a bar at the bottom replaces the menu.

  7. Type a wrong PIN three times. Start another payment to a contact and type a wrong PIN at its last step, three times. The third wrong PIN locks the PIN for 15 minutes.

When you are done

  • Start over gives you a fresh copy.
  • A copy takes sign-ins for 24 hours.
  • One network gets 10 new copies in any 24 hours.

Go further