Harden an iOS app's storage, network and entry points

import Foundation
import Security

enum KeychainError: Error { case unexpectedStatus(OSStatus) }

struct TokenStore {
    let service = "com.example.bank.session"

    private func baseQuery(_ account: String) -> [String: Any] {
        [kSecClass as String: kSecClassGenericPassword,
         kSecAttrService as String: service,
         kSecAttrAccount as String: account]
    }

    func save(_ token: Data, account: String) throws {
        let attributes: [String: Any] = [
            kSecValueData as String: token,
            // Only while unlocked; never synced, never restored to another device.
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
        ]
        var status = SecItemUpdate(baseQuery(account) as CFDictionary, attributes as CFDictionary)
        if status == errSecItemNotFound {
            let item = baseQuery(account).merging(attributes) { $1 }
            status = SecItemAdd(item as CFDictionary, nil)
        }
        guard status == errSecSuccess else { throw KeychainError.unexpectedStatus(status) }
    }

    func read(account: String) throws -> Data? {
        var query = baseQuery(account)
        query[kSecReturnData as String] = true
        query[kSecMatchLimit as String] = kSecMatchLimitOne
        var result: CFTypeRef?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        if status == errSecItemNotFound { return nil }
        guard status == errSecSuccess else { throw KeychainError.unexpectedStatus(status) }
        return result as? Data
    }

    func deleteAll() {
        SecItemDelete([kSecClass as String: kSecClassGenericPassword,
                       kSecAttrService as String: service] as CFDictionary)
    }
}

// Keychain items can outlive an uninstall; UserDefaults cannot.
// Run once at launch so a reinstalled app starts signed out.
func clearKeychainAfterReinstall(_ store: TokenStore = TokenStore()) {
    let defaults = UserDefaults.standard
    guard !defaults.bool(forKey: "hasLaunchedBefore") else { return }
    store.deleteAll()
    defaults.set(true, forKey: "hasLaunchedBefore")
}

import Foundation

// Class A: unreadable from shortly after the device locks until the next unlock.
func saveStatement(_ pdf: Data, named name: String) throws -> URL {
    let dir = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask,
                                          appropriateFor: nil, create: true)
    var url = dir.appendingPathComponent(name)
    try pdf.write(to: url, options: [.atomic, .completeFileProtection])
    var values = URLResourceValues()
    values.isExcludedFromBackup = true   // a cached copy; the server keeps the original
    try url.setResourceValues(values)
    return url
}

import Foundation
import UIKit
import UniformTypeIdentifiers
import os

let authLog = Logger(subsystem: "com.example.bank", category: "auth")

func didRefreshSession(userID: String) {
    // Dynamic strings are redacted by default; the hash mask still lets you correlate.
    authLog.info("Session refreshed for \(userID, privacy: .private(mask: .hash))")
    // print() and NSLog() write the value in clear text. Never pass them tokens.
}

func copyOneTimeCode(_ code: String) {
    UIPasteboard.general.setItems(
        [[UTType.plainText.identifier: code]],
        options: [.localOnly: true,                                  // no Universal Clipboard
                  .expirationDate: Date().addingTimeInterval(60)])
}

// Responses with account data: no disk cache, no cookies left behind.
let privateSession = URLSession(configuration: .ephemeral)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>NSAppTransportSecurity</key>
<dict>
  <!-- Vulnerable: <key>NSAllowsArbitraryLoads</key><true/> switches ATS off for every host. -->
  <!-- Fixed: keep ATS on and scope the exception to the one host that needs it. -->
  <key>NSExceptionDomains</key>
  <dict>
    <key>rates.partner.example</key>
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key>
      <true/>
    </dict>
  </dict>
</dict>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>NSAppTransportSecurity</key>
<dict>
  <key>NSPinnedDomains</key>
  <dict>
    <key>api.bank.example.com</key>
    <dict>
      <!-- Issuing-CA keys: the one in use and a backup you could move to. -->
      <key>NSPinnedCAIdentities</key>
      <array>
        <dict>
          <key>SPKI-SHA256-BASE64</key>
          <string>44viFzTC+h/L+3OHRg4Rs5v4+AcpzHZvI9Tne2RDNGk=</string>
        </dict>
        <dict>
          <key>SPKI-SHA256-BASE64</key>
          <string>9C7mf4J789KvLX59lcMyYpsH6bpdmoAGTByZNhcusLA=</string>
        </dict>
      </array>
    </dict>
  </dict>
</dict>
</dict>
</plist>
<!-- Compute a value from a PEM certificate:
openssl x509 -in ca.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 -->

import Foundation

enum Route: Equatable { case invoice(id: String) }

// Universal link: https://bank.example.com/invoices/<id>. Anything else is rejected.
func route(for url: URL) -> Route? {
    guard let parts = URLComponents(url: url, resolvingAgainstBaseURL: false),
          parts.scheme == "https",
          parts.host == "bank.example.com",
          parts.port == nil, parts.user == nil, parts.password == nil,
          (parts.queryItems ?? []).isEmpty
    else { return nil }
    let segments = parts.path.split(separator: "/", omittingEmptySubsequences: false)
    guard segments.count == 3, segments[0].isEmpty, segments[1] == "invoices",
          segments[2].range(of: "^[A-Z0-9]{8,20}$", options: .regularExpression) != nil
    else { return nil }
    // Open a read-only screen. Paying still needs the normal confirmation and
    // a server-side authorization check.
    return .invoice(id: String(segments[2]))
}

import UIKit
import WebKit

// Page messages are untrusted input: check the frame and origin, then map a
// fixed set of action names to native code. Never evaluate or open what the page sends.
final class HelpBridge: NSObject, WKScriptMessageHandler {
    static let host = "help.bank.example.com"
    private let allowedActions: Set<String> = ["openSettings", "contactSupport"]
    var onAction: ((String) -> Void)?

    func userContentController(_ controller: WKUserContentController,
                               didReceive message: WKScriptMessage) {
        let origin = message.frameInfo.securityOrigin
        guard message.frameInfo.isMainFrame,
              origin.protocol == "https", origin.host == Self.host, origin.port == 0,
              let action = (message.body as? [String: Any])?["action"] as? String,
              allowedActions.contains(action)
        else { return }
        onAction?(action)
    }
}

@MainActor
func makeHelpWebView(bridge: HelpBridge, delegate: WKNavigationDelegate) -> WKWebView {
    let config = WKWebViewConfiguration()
    config.limitsNavigationsToAppBoundDomains = true   // list the host in WKAppBoundDomains
    config.userContentController.add(bridge, name: "bridge")
    let webView = WKWebView(frame: .zero, configuration: config)
    webView.navigationDelegate = delegate
    webView.load(URLRequest(url: URL(string: "https://\(HelpBridge.host)/")!))
    return webView
}

// Call from webView(_:decidePolicyFor:decisionHandler:) in the navigation delegate.
@MainActor
func policy(for action: WKNavigationAction) -> WKNavigationActionPolicy {
    guard let url = action.request.url, url.scheme == "https" else { return .cancel }
    if url.host == HelpBridge.host { return .allow }
    if action.navigationType == .linkActivated { UIApplication.shared.open(url) }  // outside the app
    return .cancel
}

import CryptoKit
import Foundation
import LocalAuthentication
import Security

// A P-256 key generated inside the Secure Enclave. Every signature needs Face ID or
// Touch ID from the biometrics enrolled when the key was made.
enum StepUpKey {
    static func create() throws -> SecureEnclave.P256.Signing.PrivateKey {
        var error: Unmanaged<CFError>?
        guard let access = SecAccessControlCreateWithFlags(
            nil,
            kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly,
            [.privateKeyUsage, .biometryCurrentSet],
            &error) else { throw error!.takeRetainedValue() as Error }
        return try SecureEnclave.P256.Signing.PrivateKey(accessControl: access)
        // Send key.publicKey.derRepresentation to the server at enrollment, and store
        // key.dataRepresentation (an encrypted handle only this Secure Enclave can use)
        // in the Keychain.
    }

    // Sign the server's one-time challenge; the server verifies with the enrolled public key.
    static func sign(challenge: Data, keyHandle: Data) throws -> Data {
        let context = LAContext()
        context.localizedReason = "Confirm the transfer"
        let key = try SecureEnclave.P256.Signing.PrivateKey(
            dataRepresentation: keyHandle, authenticationContext: context)
        return try key.signature(for: challenge).derRepresentation
    }
}

import CryptoKit
import DeviceCheck
import Foundation

protocol AttestAPI {
    func challenge() async throws -> Data                     // ≥16 random bytes, single use
    func register(keyID: String, attestation: Data) async throws
}

// Run once per user per install, then keep keyID in the Keychain.
func enrollAppAttest(api: AttestAPI) async throws -> String? {
    let service = DCAppAttestService.shared
    guard service.isSupported else { return nil }            // fall back to other risk signals
    let keyID = try await service.generateKey()
    let clientDataHash = Data(SHA256.hash(data: try await api.challenge()))
    let attestation = try await service.attestKey(keyID, clientDataHash: clientDataHash)
    try await api.register(keyID: keyID, attestation: attestation)  // server verifies, then trusts keyID
    return keyID
}

// Sign a sensitive request: the server checks the signature, counter and challenge.
func assertion(for requestBody: Data, keyID: String) async throws -> Data {
    let clientDataHash = Data(SHA256.hash(data: requestBody))   // body embeds the server challenge
    return try await DCAppAttestService.shared.generateAssertion(keyID, clientDataHash: clientDataHash)
}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>NSPrivacyTracking</key>
  <false/>
  <key>NSPrivacyCollectedDataTypes</key>
  <array>
    <dict>
      <key>NSPrivacyCollectedDataType</key>
      <string>NSPrivacyCollectedDataTypeEmailAddress</string>
      <key>NSPrivacyCollectedDataTypeLinked</key>
      <true/>
      <key>NSPrivacyCollectedDataTypeTracking</key>
      <false/>
      <key>NSPrivacyCollectedDataTypePurposes</key>
      <array>
        <string>NSPrivacyCollectedDataTypePurposeAppFunctionality</string>
      </array>
    </dict>
  </array>
  <key>NSPrivacyAccessedAPITypes</key>
  <array>
    <dict>
      <!-- clearKeychainAfterReinstall() reads and writes the app's own defaults -->
      <key>NSPrivacyAccessedAPIType</key>
      <string>NSPrivacyAccessedAPICategoryUserDefaults</string>
      <key>NSPrivacyAccessedAPITypeReasons</key>
      <array>
        <string>CA92.1</string>
      </array>
    </dict>
  </array>
</dict>
</plist>

APP=Bank.app; HOST=api.bank.example.com; LINKS=bank.example.com

# 1. ATS and app-bound domain settings that shipped in the bundle
plutil -p "$APP/Info.plist" | grep -A12 -E 'NSAppTransportSecurity|WKAppBoundDomains'

# 2. Entitlements: associated domains, keychain groups, App Attest environment, get-task-allow
codesign -d --entitlements - "$APP"

# 3. Does the server pass ATS with no exceptions? (macOS; expect "Result : PASS")
nscurl --ats-diagnostics "https://$HOST" | grep -A1 'ATS Default Connection'

# 4. SPKI pin of the issuing CA (second certificate in the chain)
openssl s_client -connect "$HOST:443" -servername "$HOST" -showcerts </dev/null 2>/dev/null \
  | awk '/BEGIN CERT/{n++} n==2' | sed '/END CERT/q' \
  | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der \
  | openssl dgst -sha256 -binary | openssl enc -base64

# 5. The association file must come back 200 over HTTPS with no redirect
curl -sS -o /dev/null -w '%{http_code} %{content_type} %{redirect_url}\n' \
  "https://$LINKS/.well-known/apple-app-site-association"

# 6. Throw malformed links at a Simulator build; none may open an invoice screen
xcrun simctl openurl booted "https://$LINKS/invoices/INV0000123%0A"