A lost, shared or compromised device puts every file the app wrote next to an attacker, and backups and device transfers copy them further. Storage protection is what keeps a session token or account data from outliving the device the user trusted.
- Keep credentials in the platform keystore: the iOS Keychain with a
ThisDeviceOnlyaccessibility class, or data encrypted with a non-exportable Android Keystore key. - Write other sensitive files only to app-private storage, with explicit file protection on iOS.
- Never store sensitive data in
UserDefaults,SharedPreferencesor public folders in the clear. - Store as little as the feature needs, and expire local copies.
MASTG tests in the local projects
The local projects run these OWASP MASTG v2.0.0 tests for MASVS-STORAGE-1, as tests you can repeat on your own machine.
| MASTG test | Platform | Project |
|---|---|---|
| MASTG-TEST-0299: Data Protection Classes for Files in Private Storage | iOS | Keep an iOS app's storage, links and web bridge in bounds · StorageTests |
| MASTG-TEST-0300: References to APIs for Storing Unencrypted Data in Private Storage | iOS | Keep an iOS app's storage, links and web bridge in bounds · StorageTests |
| MASTG-TEST-0301: Runtime Use of APIs for Storing Unencrypted Data in Private Storage | iOS | Keep an iOS app's storage, links and web bridge in bounds · StorageTests |
| MASTG-TEST-0302: Sensitive Data Unencrypted in Private Storage Files | iOS | Keep an iOS app's storage, links and web bridge in bounds · StorageTests |
| MASTG-TEST-0207: Runtime Storage of Unencrypted Data in the App Sandbox | Android | Repair an Android app's links, components, network policy and storage · StorageTests |
| MASTG-TEST-0287: Runtime Storage of Unencrypted Data via the SharedPreferences API | Android | Repair an Android app's links, components, network policy and storage · StorageTests |
Guides on this site
Harden an iOS app's storage, network and entry points
Store secrets in the Keychain with the narrowest accessibility class, set file protection explicitly, keep App Transport Security on, prefer universal links, constrain WKWebView bridges, keep step-up keys in the Secure Enclave, verify App Attest on the server and ship an accurate privacy manifest, mapped to OWASP MASVS 2.1.
Harden an Android app's storage, network and entry points
Encrypt local secrets with Android Keystore keys now that Jetpack Security is deprecated, set transport policy in Network Security Configuration, close exported components and mutable PendingIntents, confine WebViews, verify App Links and judge Play Integrity verdicts on the server, mapped to OWASP MASVS 2.1.
Review mobile storage, links and platform permissions
Keep local artifacts and platform entry points from exposing authority that belongs on the server.
Review trust boundaries in mobile and native clients
Protect local data and platform interactions while keeping server-side authorization independent of the client’s behavior.
Worked threat model: a mobile banking app
A complete worked threat model for a mobile banking-style app: the data-flow diagram and its elements, STRIDE threats on the client, the transport and the backend, and the mitigations mapped to OWASP MASVS v2 controls and current Android and iOS platform APIs.
Practice
- Keep an iOS app's storage, links and web bridge in bounds · Local project
- Repair an Android app's links, components, network policy and storage · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
Control statements are quoted from OWASP MASVS v2.1.0, licensed CC BY-SA 4.0; the rest is this site's summary. MASTG tests are those the iOS and Android projects here run, with their titles from mas.owasp.org. License.