How to secure your mobile apps (with code samples)
Vica Cotoarba
Head of Mobile Development
Reading time: 5 min
Published: Nov 9, 2020
Key takeaways
- Mobile app security covers the process, measures and actions taken during and after development to ensure system security, data protection and privacy and to block fraud, malware, hacking and data manipulation.
- General best practices include obfuscating and minifying code, encrypting sensitive data, communicating with APIs only over HTTPS, and using tokens instead of device identifiers for sessions.
- Store credentials and certificates in the Keychain on iOS or the Keystore on Android, and follow the Principle of Least Privilege by requesting only the permissions the app truly needs.
- On iOS you can block screen recording and screenshots, apply file protection classes like NSFileProtectionComplete, and restrict debug logs to debug builds only.
- On Android, share content securely with content:// URIs and granular permissions, disallow other apps from accessing your ContentProvider objects, and add a network security configuration.
What is Mobile App Security and Why is it important? A guide on How to secure your mobile apps
Mobile app security represents the entire process, measures, and actions taken during the app development process and after it in order to ensure system security, data protection, and privacy, and block any form of digital fraud, malware, hacking, or data manipulation
Mobile apps are at our fingertips nowadays and no matter why and how we use them - be it for work, social purposes, personal finance, or just for entertainment, apps are part of our day-to-day activities. Hence, having a secured mobile app is critical so the customers are not at risk with their data.
We asked Dan Ilieș, our Head of Mobile Development at Wolfpack Digital if he has any suggestions on how to ensure your mobile app is secure, no matter if we talk about an Android app or an iOS app, and to provide us with a few tips and tricks.
How to secure Mobile Apps. General Security Best Practices
- Obfuscate and minify your code so it cannot be reverse-engineered.
When we think about obfuscation we consider the process of modifying the code in order to make it impossible to read. And minification allows the developer to reduce the sample code by around 50-60% in size and it is used for both speed optimization and security.
- Encrypt all sensitive data
Make sure you store very sensitive information like credentials and certificates in the Keychain (iOS) or Keystore (Android).
- Communicate with APIs only over HTTPS
similar to web applications’ security, the mobile apps’ APIs should only go through an encrypted connection.
- Use tokens instead of device identifiers to identify a session.
A token can be revoked at any time because a token-based auth will create a unique encoded token to be checked every time a request is made, without storing the data and it has a set lifetime value and can be changed or revoked whenever needed.
- Make sure the WebView objects in your app will not allow users to navigate to sites that are outside of your control.
- Use secured code libraries and be extra cautious before using them - e.g., review their code on GitHub before using them
- Enforce strong passwords and multi-factor authentication. Needless to say, the more complicated the password is and the more factors it has, the harder it is to break it. As developers, requiring a user to create strong passwords and use 2FA or something similar is not hard and you keep everyone’s data secured.
- Follow "The Principle of Least Privilege": an app should only require the permissions that are absolutely needed and no more.
3 best practices to keep your iOS app secured (with code samples)
1. How to avoid Screen recording and capturing on iOS apps
- can be avoided by observing: userDidTakeScreenshotNotification o detect screenshots
- can also use UIScreen.isCaptured() to detect to detect screen recording
2. When a new file is to be saved, a developer can choose from multiple protection options.
And we highly recommend you to use NSFileProtectionComplete or NSFileProtectionCompleteUnlessOpen.
<code example>
- Encrypting an existing file on disk
<code example>
3. Debug Logs Enabling
Unnecessary Debug Logs through the app might print sensitive information and method completion. This is riskier at release builds.
The fix for this would be to use #ifDef DEBUG to enable logs only on debug builds.
<code example>
3 best practices to keep your Android app secured (with code samples)
- Here’s how to share your app's content with other apps securely
- Enforce read-only or write-only permissions (as needed, of course)
- Provide clients’ one-time access to data by using the FLAG_GRANT_READ_URI_PERMISSION and FLAG_GRANT_WRITE_URI_PERMISSION flags.
- When sharing data, use "content://" URIs, not "file://" URIs. Instances of FileProvider do this for you.
<code example>
- disallow other developers' apps from accessing the ContentProvider objects. Unless you intend to send data from your app to a different app that you don't own, you should explicitly disallow other devs’ access to your app content.
<code example>
3) Add a network security configuration. This allows you to change the configuration without modifying any app code.
<code example>
