3

I currently found something interesting when browsing my iPhone app's cache.db file.

There is a table called cfurl_cache_receiver_data and there is a column called receiver_data. This contains all the HTTP Request response that my app receives from the API. The problem is there is an HTTP request that responds with the user's API key. The column shows this data in plain text.

My question is should I worry about this? We do have a way where the user can change/delete their API key as a safety protocol.

Edit :

This is where I found the cache.db just in case it helps someone understand my concern.

/Users/(username)/Library/Developer/CoreSimulator/Devices/B24F612C-8DC2-4599-86EB-BC6D75FF05DE/data/Containers/Data/Application/97AEA1EE-28B4-4744-B23B-FA5424F98E49/Library/Caches

Ive updated my question because all the data in this column is actually responses from the API and not requests I send out.

1

This is stored on the users device in a directory only accessible to your app. How do you store the API key for the user normally? If the answer is in plaintext then this is no less secure.

If you store the API key in an encrypted environment - say the keychain - then this makes that protection pointless.

If you are concerned set the cache control headers appropriately on sensitive requests. I.e.

Cache-Control: no-cache, no-store

  • Thank you for the answer. Currently I send it plain text to the API. The api key is stored in my sqlite database along with other user data (not the cached db.) Should I store the api key in a keychain? I heard people say it is pointless to have api key in a keychain. – Curt Rand Dec 19 '17 at 19:04
  • So if it's in your sqlite in the same app directory what difference does it make that it's in the cache? When you say plaintext I hope you use HTTPS? - If not you should be worrying about that long before this! There are advantages to saving the key in the key chain but they are minor at best. – Hector Dec 19 '17 at 19:20
  • Yes, I use HTTPS. The database in the App directory is removed when user logs out, but not the cache.db. That's why I was a little worry. Not only do we use HTTPS, but we also have a way to delete the api key. So if it were to be stolen, the user can't use it. – Curt Rand Dec 19 '17 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.