3

Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code.

Isn't that a security vulnerability since string literals can be extracted from the app binary, e.g., by using the strings command?

Neither the Facebook SDK for iOS nor the AWS Mobile SDK for iOS asks you to hardcode your API secret into your iOS app's source code. To authenticate client requests, the Facebook SDK for iOS seems to use some sort of signing algorithm and the AWS Mobile SDK for iOS uses pre-signed URLs & Amazon Cognito Identity.

Improve this question
1
  • 2
    You just answered your own question. No, it is not safe to hardcode key's in any application.
    – Jeroen
    Jun 18 '15 at 4:37
2

The API-SECRET as the name implies is secret and therefore should never be revealed in the client-side (nor on mobile applications).

This credential is being used for generating signatures which can then be used for listing, deleting, overwriting and editing your content.

You should either store it on the server side and pass only the generated signature, or use client-side unsigned methods which don't require signatures.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.