The pillars of iOS app security

Security Mid-level Swift 5.0+ iOS 17+ Reviewed By Alok Singh

Pick the fix

Which plan gives real defence in depth?

Options
Hint 1 of 1

What can an attacker with the binary do?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Keychain and file protection for data, HTTPS with ATS, short-lived tokens, App Attest, and server-side checks for every permission

Correct. Every layer is covered, and the server makes the final decision.

Why not the others?
  • B Obfuscate the binary and trust the app's checks. Obfuscation slows attackers down but doesn't stop them.
  • C Jailbreak detection only. It's easy to bypass and protects nothing on its own.
  • D Encrypt UserDefaults with a key hard-coded in the app. Anyone can extract the key from the binary.

30-second answer

Protect data at rest (Keychain for secrets, file protection, no sensitive data in logs or UserDefaults), data in transit (HTTPS with ATS, optionally pinning), and access (strong authentication, biometrics backed by the Keychain, short-lived tokens). Rely on the platform (sandbox, code signing, App Attest) and assume the client can be inspected, so the server enforces every rule that matters.

Practise saying it · 45 s. No recording, just a timer

Explain the pillars of app security.

Say your answer out loud, then check which of these points you covered:

  • Data at rest
  • Data in transit
  • Access
  • Server enforcement

Deep dive

Never trust the client for authorization decisions.

Redact secrets and personal data from logs and crash reports.

Blur or hide sensitive screens in the app switcher snapshot.

Use App Attest to check requests come from your genuine app.

Common mistakes

  • Hard-coding secrets in the binary.
  • Enforcing permissions only in the app.

Senior take & follow-ups

Seniors lead with the threat model and put enforcement on the server.

Follow-up questions

Think of your answer first, then open the hint.

  1. What does App Attest prove?

    Show hint

    That a request comes from a genuine instance of your app on a real device.

  2. Why hide sensitive screens in the app switcher?

    Show hint

    The system takes a snapshot when the app goes to the background.

Related questions

Suggest a fix if something here is wrong or out of date.