Use HTTPS certificate handling to protect your iOS app

• Tuesday 10th of September 2024
• admin
• 1

Any app that connects over the Internet to a hosted service must have a security policy in place. The security policy will depend primarily on the sensitivity of the data being transferred between the app and the server. However, even if the app doesn't transfer sensitive customer information, it should protect itself from attack. Even the least harmful attack will ruin the user's experience and the app's reputation.

Today most web services (including Twitter and Facebook) require request authentication with OAuth as part of getting login credentials from the user. The developer gets a consumer and secret key after registering the app. When the app accesses the web service, the app first exchanges its encoded keys for a bearer token. For the life of this token, the app has permission to access the service's API.

A man-in-the-middle attack is a form of active eavesdropping in which the attacker inserts itself in the middle of an Internet connection between the iOS app and a server. 

1. Normal traffic between mobile app and server.
2. The attacker gets the request from the app and makes changes to it.
3. The request is forwarded to the server.
4. The attacker gets the response from server and makes changes.
5. The response is forwarded to the app.

It is highly recommended that your app access a web service that is protecting itself with OAuth authentication.

Along with OAuth, there is HTTPS, which puts HTTP on top of the SSL/TLS protocol, providing data encryption and X.509 certificate exchange. It is possible with iOS to use only the data encryption and turn off certificate exchange, but in most cases this isn't necessary. Apple has installed many root certificates from trusted certificate authorities.

If the server your app is accessing has a self-signed certificate installed, you can continue without or bypass the credential you recei