Secure development on iOS: Swift code review and fixes
You find and fix security mistakes in Swift apps from the source: Keychain and data protection, crypto, biometrics, network trust, links, web views and privacy.
Level 301 · 22 lessons · 18 practice labs
Lessons
Swift and the project
- Swift for reviewers: optionals, structs, closures
- Layout of an iOS project: targets, plist, the entitlements file
- Swift packages and unit tests with swift test
- Build settings, xcconfig and keeping secrets out of the repository
- Short task: explain the path a token takes through a small Swift module
Storage and crypto
- Using the Keychain: the right accessibility value
- Choosing a file protection class in code
- The mistake of writing sensitive data to UserDefaults and plists
- Correct encryption and key derivation with CryptoKit
- Secure Enclave keys and biometry-bound access
- Short task: move code that writes a token to UserDefaults into the Keychain and write its test
Authentication and network
- The biometric pitfall: trusting only a yes/no answer
- Server trust evaluation and pinning in URLSession
- ATS configuration in a project
- Login flows: the system authentication session and passkeys
- Short task: fix delegate code that accepts every certificate
Platform interaction and privacy
- Validating URL scheme and universal link input
- Hardening WKWebView: message handlers and local file access
- Pasteboard, the app switcher snapshot and keyboard cache
- Logging and privacy markers
- Short task: fix a link handler that starts an action without validating its parameter
Capstone
- Capstone: review, fix and prove with tests the Swift code of a budget tracking app
Practice labs
- Find where the token is stored in a Swift module: Show the call that writes the token in the source files.
- Fix a crash caused by force-unwrapping: Replace the force-unwrapped value with safe binding and pass its test.
- Clean a build secret committed to the repository: Move the key in the xcconfig file out of version control and report that it remains in history.
- Find the sensitive value written to UserDefaults: Find the line that writes the password to preferences.
- Move the token to the Keychain: Move the storage class to the Keychain wrapper and verify with swift test.
- Choose the right accessibility and file protection class: Fix the item left always-accessible and the file written without protection, and test the choice.
- Find the code that uses a constant key: Show the symmetric key embedded in the source.
- Move encryption to CryptoKit AES-GCM: Replace hand-rolled encryption with an authenticated mode and pass the tests.
- Fix deriving a key from a password: Move a key derived by a single hash to salted, iterated derivation and show by test that two users get different keys.
- Find the delegate that accepts every certificate: Show the unconditional accept line in the URLSession delegate.
- Fix server trust evaluation: Restore default evaluation and test with a stub that a bad certificate is refused.
- Bind biometrics to a Keychain item: Replace a flow that looks only at a yes/no answer with an access-controlled item and test the logic.
- List the parameters the URL scheme handler reads: Extract the parameters used in the handler code.
- Fix a handler that starts an action without validating: Add format and session checks to universal link input and test three bad inputs.
- Narrow a WKWebView message handler: Limit a handler open to every page to your own domain and turn off local file access.
- Find personal data written to the log: Find the log calls that print email and phone number.
- Hide a sensitive screen in the app switcher snapshot: Add logic that shows a cover when backgrounding and test the state transition.
- Review a budget app's Swift code and fix two flaws: Extract six findings, fix the storage and network trust flaws and prove it with tests.
About this course
You find and fix security mistakes in Swift apps from the source: Keychain and data protection, crypto, biometrics, network trust, links, web views and privacy.
What you will learn
- Swift and the project
- Storage and crypto
- Authentication and network
- Platform interaction and privacy
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.