Mobile App Security: Complete Developer Guide

import Security

struct KeychainManager {
    static func save(key: String, data: Data) -> OSStatus {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]

        // Delete any existing item first
        SecItemDelete(query as CFDictionary)

        // Add the new item
        return SecItemAdd(query as CFDictionary, nil)
    }

    static func load(key: String) -> Data? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]

        var item: CFTypeRef?
        let status = SecItemCopyMatching(query as CFDictionary, &item)

        guard status == errSecSuccess else { return nil }
        return item as? Data
    }

    static func delete(key: String) -> OSStatus {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key
        ]
        return SecItemDelete(query as CFDictionary)
    }
}

// Usage
let token = "user_auth_token_123"
KeychainManager.save(key: "auth_token", data: Data(token.utf8))

if let loaded = KeychainManager.load(key: "auth_token") {
    print(String(data: loaded, encoding: .utf8)!) // "user_auth_token_123"
}

import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey
import javax.crypto.spec.GCMParameterSpec

class SecureStorage(context: Context) {
    private val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
    private val prefs = context.getSharedPreferences("secure_prefs", Context.MODE_PRIVATE)

    fun saveData(key: String, data: String) {
        val secretKey = getOrCreateKey(key)
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        cipher.init(Cipher.ENCRYPT_MODE, secretKey)

        val iv = cipher.iv
        val encrypted = cipher.doFinal(data.toByteArray(Charsets.UTF_8))

        // Store IV + encrypted data
        prefs.edit().putString(key, android.util.Base64.encodeToString(iv + encrypted,
            android.util.Base64.NO_WRAP)).apply()
    }

    fun getData(key: String): String? {
        val encryptedBase64 = prefs.getString(key, null) ?: return null
        val encrypted = android.util.Base64.decode(encryptedBase64, android.util.Base64.NO_WRAP)

        val secretKey = getOrCreateKey(key)
        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
        cipher.init(Cipher.DECRYPT_MODE, secretKey, GCMParameterSpec(128, encrypted.copyOfRange(0, 12)))

        return String(cipher.doFinal(encrypted.copyOfRange(12, encrypted.size)))
    }

    private fun getOrCreateKey(alias: String): SecretKey {
        if (keyStore.containsAlias(alias)) return keyStore.getKey(alias, null) as SecretKey

        val keyGenerator = KeyGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_AES, "AndroidKeyStore"
        )
        keyGenerator.init(
            KeyGenParameterSpec.Builder(
                alias, KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
            )
                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                .setKeySize(256)
                .build()
        )
        return keyGenerator.generateKey()
    }
}

class PinnedURLSessionDelegate: NSObject, URLSessionDelegate {
    func urlSession(_ session: URLSession,
                    didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {

        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
              let serverTrust = challenge.protectionSpace.serverTrust else {
            completionHandler(.performDefaultHandling, nil)
            return
        }

        // Load your pinned certificate
        guard let pinnedCertData = NSDataAsset(name: "api.dodatech.com")?.data else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }

        let credential = URLCredential(trust: serverTrust)
        completionHandler(.useCredential, credential)
    }
}

val certificatePinner = CertificatePinner.Builder()
    .add("api.dodatech.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
    .build()

val client = OkHttpClient.Builder()
    .certificatePinner(certificatePinner)
    .build()

// build.gradle.kts (app level)
android {
    buildTypes {
        release {
            isMinifyEnabled = true           // Enable R8
            isShrinkResources = true         // Remove unused resources
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro"
            )
        }
    }
}

// Build Settings → Optimization Level → Release: Optimize for Speed [-O]
// Strip Swift Symbols: YES
// Deployment Postprocessing: YES

fun isDeviceRooted(): Boolean {
    // Check for known root binaries
    val rootPaths = listOf(
        "/system/app/Superuser.apk",
        "/system/bin/su",
        "/system/xbin/su",
        "/data/local/xbin/su",
        "/data/local/bin/su",
        "/system/sd/xbin/su",
        "/system/bin/failsafe/su",
        "/data/local/su"
    )

    for (path in rootPaths) {
        if (File(path).exists()) return true
    }

    // Check build tags
    val buildTags = android.os.Build.TAGS ?: ""
    if (buildTags.contains("test-keys")) return true

    return false
}

func isJailbroken() -> Bool {
    let cydiaPath = FileManager.default.fileExists(atPath: "/Applications/Cydia.app")
    let aptPath = FileManager.default.fileExists(atPath: "/private/var/lib/apt/")

    // Check if we can write outside app sandbox
    let sandboxPath = "/private/" + UUID().uuidString
    let canWriteOutsideSandbox = (try? "test".write(toFile: sandboxPath, atomically: true, encoding: .utf8)) != nil
    try? FileManager.default.removeItem(atPath: sandboxPath)

    return cydiaPath || aptPath || canWriteOutsideSandbox
}

// Always use HTTPS — never HTTP
// Never log auth tokens
// Use short-lived tokens (15-60 min) + refresh tokens
// Validate server certificate (see certificate pinning above)

// Example: Secure API client
class SecureApiClient {
    private val client = OkHttpClient.Builder()
        .connectTimeout(30, TimeUnit.SECONDS)
        .addInterceptor { chain ->
            val request = chain.request().newBuilder()
                .addHeader("Authorization", "Bearer ${getToken()}")
                .addHeader("X-Request-ID", UUID.randomUUID().toString())
                .build()
            chain.proceed(request)
        }
        .certificatePinner(certificatePinner)
        .build()
}

// 🚨 NEVER do this in production
val trustAllCerts = arrayOf<TrustManager>(object : X509TrustManager {
    override fun checkClientTrusted(p0: Array<X509Certificate?>, p1: String?) {}
    override fun checkServerTrusted(p0: Array<X509Certificate?>, p1: String?) {}
    override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf()
})

// 🚨 Token visible in logcat
Log.d("Auth", "Token: $token")
// ✅ Log metadata only
Log.d("Auth", "Token obtained: ${token.take(4)}...${token.takeLast(4)}")

// 🚨 MD5 is not secure for passwords
// ✅ Use bcrypt, scrypt, or Argon2 for password hashing
// ✅ Use AES-256-GCM for encryption
// ❌ Avoid: MD5, SHA1, DES, RC4, ECB mode