4

I currently found something interesting when browsing my iPhone app's cache.db file.

There is a table called cfurl_cache_receiver_data and there is a column called receiver_data. This contains all the HTTP Request response that my app receives from the API. The problem is there is an HTTP request that responds with the user's API key. The column shows this data in plain text.

My question is should I worry about this? We do have a way where the user can change/delete their API key as a safety protocol.

Edit :

This is where I found the cache.db just in case it helps someone understand my concern.

/Users/(username)/Library/Developer/CoreSimulator/Devices/B24F612C-8DC2-4599-86EB-BC6D75FF05DE/data/Containers/Data/Application/97AEA1EE-28B4-4744-B23B-FA5424F98E49/Library/Caches

Ive updated my question because all the data in this column is actually responses from the API and not requests I send out.

Improve this question

2 Answers 2

Reset to default
3

This is stored on the users device in a directory only accessible to your app. How do you store the API key for the user normally? If the answer is in plaintext then this is no less secure.

If you store the API key in an encrypted environment - say the keychain - then this makes that protection pointless.

If you are concerned set the cache control headers appropriately on sensitive requests. I.e.

Cache-Control: no-cache, no-store

Improve this answer
3
  • Thank you for the answer. Currently I send it plain text to the API. The api key is stored in my sqlite database along with other user data (not the cached db.) Should I store the api key in a keychain? I heard people say it is pointless to have api key in a keychain.
    – Curt Rand
    Commented Dec 19, 2017 at 19:04
  • So if it's in your sqlite in the same app directory what difference does it make that it's in the cache? When you say plaintext I hope you use HTTPS? - If not you should be worrying about that long before this! There are advantages to saving the key in the key chain but they are minor at best.
    – Hector
    Commented Dec 19, 2017 at 19:20
  • Yes, I use HTTPS. The database in the App directory is removed when user logs out, but not the cache.db. That's why I was a little worry. Not only do we use HTTPS, but we also have a way to delete the api key. So if it were to be stolen, the user can't use it.
    – Curt Rand
    Commented Dec 19, 2017 at 19:24
1

If your app were installed onto a jailbroken device, all that data would be exposed. Hopefully, it's not a likely scenario, but technically, it's still possible.

You can instruct the cache to be in memory by doing the following.

URLCache.shared.removeAllCachedResponses()
URLCache.shared = URLCache(memoryCapacity: 50 * 1024, diskCapacity: 0, diskPath: nil)

I put this code into the AppDelegate and it works great.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .