For an iOS app that communicates with a RESTful service over HTTPS, should the session key be stored in Keychain or NSUserDefaults? Username and password are stored in Keychain, and it would seem trivial to also store the sessionKey.

But from a security standpoint, does that get you any added security? Presumably if somebody is able to get to your NSUserDefaults, they're also able to see your HTTPS requests traffic from that app?

  • 2
    I'm not an iOS developer, but session keys should not be stored anywhere persistent. Keychains are usually persistent databases so would be unsuitable. A session key lives in memory only. – lynks Jul 11 '13 at 16:01
  • 1
    Same disclaimer (I'm not an iOS dev), but it would be even better to not store the username:password, but rather get a token from the service (if possible) and only store that in the keychain. That way the user can revoke access without changing the password, and there's no risk of the password leaking… – Joel L Jan 31 '14 at 15:14

NSUserDefaults is not encrypted and is stored in a plain text .plist file - it can be easily opened and read, both on device and when synced to a Mac. NSUserDefaults is for preferences, not for storing secure login information Sensitive data like passwords and keys. Keys should be stored in the Keychain. Apple's Keychain Services Programming Guide states that a "keychain is an encrypted container that holds passwords for multiple applications and secure services. Keychains are secure storage containers, which means that when the keychain is locked, no one can access its protected contents". Moreover, in iOS, each application only has access to its own keychain items.

As lynks suggested, session keys should not be stored persistently. Regardless, I recommend viewing the following examples/frameworks:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.