App sandboxing

Security Junior Swift 5.0+ iOS 17+ Reviewed By Alok Singh

Pick the fix

The app and its widget need the same JSON file. Where should it go?

Options
Hint 1 of 1

Which container do both targets share?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A A shared App Group container

Correct. Both targets with the App Group entitlement can read it.

Why not the others?
  • B The app's Documents directory. The widget runs in its own sandbox and can't see it.
  • C UserDefaults.standard. standard is per-target; you'd need a suite for the App Group.
  • D An absolute path written at build time. Container paths change, and the sandbox blocks other containers.

30-second answer

Each iOS app runs in its own sandbox: it can read and write only its own container and must ask permission for protected resources like photos, location and contacts. To share data with your own extensions or apps, use an App Group container and shared Keychain access groups. To share with other apps, use the share sheet, document pickers, or universal links and URL schemes.

Practise saying it · 30 s. No recording, just a timer

Explain the sandbox.

Say your answer out loud, then check which of these points you covered:

  • Own container
  • Permissions
  • App Groups for sharing

Deep dive

Entitlements in the provisioning profile grant capabilities such as App Groups.

The container path changes, so never store absolute paths.

Privacy usage descriptions are required before asking for permissions.

Extensions run in their own process with their own sandbox.

Common mistakes

  • Trying to read another app's container.
  • Hard-coding container paths.

Senior take & follow-ups

Seniors know which sharing mechanism fits each boundary.

Follow-up questions

Think of your answer first, then open the hint.

  1. How does a widget read the app's data?

    Show hint

    Through an App Group container.

  2. Where do you see an app's entitlements?

    Show hint

    In its provisioning profile and the signed binary.

Related questions

Try it in a free tool

Suggest a fix if something here is wrong or out of date.