Network Security Authorization List (NSAL)

Xbox One uses the endpoint configuration in your Network Security Authorization List (NSAL) to establish secure and authenticated connections to your web services. The NSAL is retrieved from Xbox Live, and you manage the contents of the NSAL as part of your title’s configuration in the Xbox Developer Portal (XDP).

NSAL Configuration on Xbox Developer Portal

The NSAL configuration on XDP is split into two sections: configuration for Endpoints and selection of Endpoints for the NSAL. The configuration of Endpoints is performed on a publisher level and all configured Endpoints are available for all titles of this publisher. NSAL configuration is performed for a specific title instance.

Endpoint Configuration

The following information is configured for an endpoint on XDP.

Property	Description
Host Type	Specifies the type of identifier for the Host property. Can be one of the following. "FQDN" - a fully qualified domain name, like "contoso.com" "wildcard" - a domain name that uses the '' character as a wildcard to match subdomains, like ".contoso.com" "IP" - an IPv4 or IPv6 literal string, like "1.2.3.4" "CIDR" - an IPv4 or IPv6 literal with mask, like "1.2.3.4/24"
Protocol	Can be "http" or "https".
Host Name	Specifies the host name identifier. The Host Type specifies which host name type is allowed.
Port	Specifies the port number. If not specified and the protocol is http or https, then the default port for the protocol will be used.
Path	Specifies the resource path for the end point. This should match according to longest prefix rules. If not specified, then all paths are matched. Not specifying a path, setting Path to an empty string, and setting Path to "/" are all equivalent.
Requires Single Sign On Token	Specifies if the endpoint uses an XSTS token. XSTS tokens are automatically added to HTTP requests to the endpoint when using the IXMLHttpRequest2 API.
Token Type	Can only be "JWT".
Token Definition	Specifies the XSTS token that is used for the endpoint. Needs to be specified when "Requires Single Sign On Token" is checked.
Signature Policy	Specifies an optional custom signing policy. All requests to this endpoint must be signed according to the policy. If no signing policy is specified then the request does not have to be signed.
Service Certificate Chain	Specifies a custom certificate chain for TLS connections to this endpoint. Should only be used for self-signed certificates during development.

When configuring endpoints it is possible to specify multiple wildcard and FQDN host types that overlap but have different token definitions associated to them. For these configurations any URL will be matched to the most specific endpoint definition, even if there is an overlap.

For example, “*.contoso.com” is configured with token definition A and “service1.contoso.com” with token definition B. A call for the URL “service1.contoso.com” will use token definition B although there is an overlap with the less specific wildcard host type.

Local NSAL Configuration Override (NSAL.json)

While you can use the NSAL on XDP during development, it is sometimes necessary for development code to run in environments where XDP is not accessible. For development purposes only, you can create a local NSAL file on your dev kit. You create this file as xs:\nsal.json. Your code is always able to access the services on Xbox Live. Those services do not need to be explicitly mentioned in the NSAL.

Note Do not use the NSAL.json override unless you currently do not have configuration access through XDP. Using local override can hide or change configuration issues, and developers who rely heavily on it may encounter delays and extra debugging time during certification. Start working with the XDP configuration NSAL as early as possible and remove any local NSAL.json overrides from your packages.

Example

This nsal.json file establishes relying party settings for Single Sign On:

        {
        "EndPoints": [
        {
        "Protocol": "https",
        "Host": "user.contoso.com",
        "RelyingParty": "http://user.contoso.com",
        "SubRelyingParty": "http://user-msa.contoso.com",
        "TokenType": "JWT",
        "HostType": "fqdn"
        },
        {
        "Protocol": "https",
        "Host": "*.microsoft.com",
        "RelyingParty": "http://microsoft.com",
        "TokenType": "JWT",
        "HostType": "wildcard"
        },
        {
        "Protocol": "https",
        "Host": "microsoft.com",
        "RelyingParty": "http://microsoft.com",
        "TokenType": "JWT",
        "HostType": "fqdn"
        }]
        }