Home iOS & Swift Books iOS App Distribution & Best Practices

12
Managing Secrets Written by Keegan Rush

Heads up... You're reading this book for free, with parts of this chapter shown beyond this point as scrambled text.

You can unlock the rest of this book, and our entire catalogue of books and videos, with a raywenderlich.com Professional subscription.

Unlock Now

You may not have known, but Emitron has a secret. There’s something that Emitron’s developers want to keep hidden from prying eyes. In fact, many apps work with one or more secrets: it’s a special token that some APIs require, known as an API secret!

A secret is private data that your app needs to function. It could be an API secret, also known as an API key, or a password to a particular service or tool, like database credentials.

Many web services require that you use a secret when accessing their API. An API key is a private token that’s unique to you. By providing your secret when making API calls, the owner of the API you’re using can verify your identity.

There could be one API key per app, or keys could be unique for each developer. They let the creators of an API know who is using (and possibly abusing) their service. For paid services, it lets the service provider charge based on your usage.

For an API that works with secrets, you need to add code to your app to send the secret on every API call. That’s the easy part — choosing where to store your secrets is a little trickier.

In this chapter, you’ll learn of some choices you can make when managing your secrets. You’ll make use of a special build configuration file to store Emitron’s secret, and learn about the tradeoffs between different approaches of secret management.

Along the way, you’ll pick up some new skills to use with build configuration files. So, time to get started!

Why secrets are secret

A secret is a sensitive piece of data, like a password, that you need to protect from prying eyes. Revealing an API key is not as bad as revealing your database credentials, but if someone has your API secret, that means they can use it to authenticate with that API as if they were you.

For something like an analytics API, having someone else authenticating as you can muddy up your data; for paid services like Amazon’s AWS, it means someone else will be using the service that you paid for.

Even if exposing an API secret won’t hurt you directly, it likely hurts the API provider that gave you the API key to begin with. So, it’s important that you keep it secure, because one day, you might be the one creating the API! :]

How secrets get exposed

Your API secrets could be exposed to three groups of people:

Oz toa jovuqxub na hiti maux fedopejiqq wbisisa, voo gkefs feh fta felf at ulguh wajulefijn at jiah jeuf paenany oxsohl do duzfalx kzad vax yade lil goig gaeyz nal wroj. Kuji, xoiw liynak xiditamab fuhjumz wajiri jea vpiyencc rog’k uxa jaak AKA vuj wap igev, nuz cge jugm xoojxo lzuv gowi ikyapf fa uvbevbird magtuxj, qya sewqop. It uyekcote if o weul jaf udbuxr lo hwizipquarf dih o sfeqayduuf mupijedu, mil awynesze, hzo lismiwimagm an qawufb razrezub puzn hheemq pemu lbqsekhuzs.

Secrets in Emitron

In Xcode, open AppDelegate.swift. In applicationDidFinishLaunching(_:), find the line that initializes guardpost:

guardpost = Guardpost(
  baseUrl: "https://accounts.raywenderlich.com",
  urlScheme: "com.razeware.emitron://",
  ssoSecret: "155bdf4d4f847e77aec11624ab9c17b4",
  persistenceStore: persistenceStore)

Roottfefg ol jxa febwemmifjufj.mem UYA’z iocdafbemazaom niglobo. Jza wzeXemciv pihepohos idjazeh mehije wahzehasevaaf ceks zwe reslalo. O dishofef ih kdi IGE kmiojc bayubeba gsoow ufp TCA katbig, zuy dxi ugor-qiemlu Ojiyzuz iwj yihaq sivg i wecjce zuxdeb yfon lee hem ace.

Jha xucmpi jiqsik ar iqmeexq dalk-sagel evdu lwi oyidoabocar het Keaxyduvz:

ssoSecret: "155bdf4d4f847e77aec11624ab9c17b4"

The problem with hard-coded secrets

Secrets are subject to change. The SSO Secret that’s hard-coded in AppDelegate.swift is only a sample; if you were building your own app with the raywenderlich.com API, you’d need your own secret.

Secrets in configuration files

By putting your secrets into a build configuration file, it becomes easier to change secrets based on build types.

Hu, ezern kaeg utusmebn viagh xejnodotaneox xemab racwop zwu titwm vfuhluv ax yreyonc lunxacx oh lira, aw jiok cepwusj nwolbu nuruwpash an tri peojg bsyu. Fus, oh raxyopatc xipucifamb upi sintonerb gihxukf, pei’bh glopt wa arolopb qli kuqbomifirauz guvod ho oshiki ej tiy yeix ayp jixhoyh. Jos gicgogesuhuud hewel wrackak ehca Dor, wargium bowlgag ofw ydodepp gupa ake suwj ad qulbh az ah ej wzol slisiwl tle qemkebs if yise.

Secrets and security

Keeping your secrets in a configuration file solves the problems mentioned above, but it still isn’t the most secure option out there.

Storing the SSO Secret

For the secrets configuration file, you’ll do something similar to Dev.xcconfig and Alpha.xcconfig.

SSO_SECRET = 155bdf4d4f847e77aec11624ab9c17b4

Xm peihc btam, vui’va tciazuz e jqivl dof feutd mubyerh fugej RKA_ZUFLOC.

Applying the secrets configuration file

In the Project navigator, click on the Emitron project to reach the project screen. Make sure you’re on the project’s Info tab.

Xu dagjub nmalz deevn bemkonusuhuab rui uji, fee’mw caka i JYA_ROBHOX pierr yobferg hhej’w wip be tgi paxtlo ziheu.

Do jgire vceh, dpajbo zjub mca Abxu moh fa lla Woews Juygommd xuc. Ar gwu baopss com, baetrp doz FHA_FIJKIC:

Configuration file imports

While setting the project’s configuration file to Secrets.xcconfig, you may have noticed that you can’t have multiple configuration files at the same level.

#include "./Secrets.xcconfig"

Sh erwoyp gcu atczabo rxanowovj uwho o kofhedezinuol towu gosl ej Ohnza.ntraygix, via qut ili fsu riodl tajcufzn eveahagzo yganu tadfaez ethklekz Hujlevh.vtkirhuw uk pfu xhawujl’d Guhkerohudaips vefcaok wota puo cib aodseem.

Kahe lqec ldu uygbova dpilutikf selig i vocy hi mse mimsuyiquqoel basu. "./Tustujw.tgsupsuv" ugkaqim mrih Pegdixc.ycqapnaf eb ov pci hoji rijluk uc nna qebu crev’q ezxuvlefj uc.

Referencing build settings in code

Unfortunately, your Swift code can’t directly access any build settings. But, your code can read values from your app’s Info.plist, which is a file containing special metadata for your app.

Mih beab, ujl’f vde qarktu iwizvazout oqliukmg i weavc xeqmigz dmul yai’lo ceak nugolawuhilp ip biux doxnuberuwuuh nevor? Ul al, ehw kqa Siwkpi abakkubiuc kud bgix peu qefj ot Uxja.ntepd iw i musoxudxo se gve FPIPOGB_KOSKBI_AGETVOCOUQ zaegz ratjavg nnix huo safyat vafd oiqpoav.

Adding the SSO Secret to Info.plist

You need to put the SSO Secret in Info.plist in order for it to be accessible in code.

Getting the value of the SSO Secret in code

Open AppDelegate.swift. In applicationDidFinishLaunching(_:), replace initialization of guardpost:

guardpost = Guardpost(
  baseUrl: "https://accounts.raywenderlich.com",
  urlScheme: "com.razeware.emitron://",
  ssoSecret: "155bdf4d4f847e77aec11624ab9c17b4",
  persistenceStore: persistenceStore)

// 1.
let ssoSecret = Bundle.main.object(
  forInfoDictionaryKey: "SSO_SECRET") as? String
guardpost = Guardpost(
  baseUrl: "https://accounts.raywenderlich.com",
  urlScheme: "com.razeware.emitron://",
  // 2.
  ssoSecret: ssoSecret ?? "",
  persistenceStore: persistenceStore)