Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix keychain key bug #237

Merged
merged 14 commits into from
Feb 6, 2024
Merged

Fix keychain key bug #237

Changes from 1 commit
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
eb6e9cb
Use actual kSec key names in KeychainAttribute.Attribute case names
mdmathias Jan 20, 2024
10cac9e
Use data protection and access group attributes in macOS example
mdmathias Jan 20, 2024
b3f59fa
Update KeychainAttribute.swift to check availability for iOS, tvOS, a…
mdmathias Jan 25, 2024
38279a9
Remove availability checkin KeychainHelper.swift
mdmathias Jan 25, 2024
f1c5892
Add keychain access group attribute and entitlement
mdmathias Jan 25, 2024
3ca4379
Add macOS example entitlement file
mdmathias Jan 25, 2024
4f9f90d
Check availability static property for useDataProtectionKeychain
mdmathias Jan 26, 2024
841d54a
Add test verifying the correct keychain attributes are used
mdmathias Jan 26, 2024
e6630b4
Add doc comments and constants to build access group
mdmathias Jan 29, 2024
ca3a392
Update KeychainHelper protocol to take optional CFString
mdmathias Jan 31, 2024
25a950c
Add method to KeychainHelper protocol taking no accessibility
mdmathias Jan 31, 2024
c30b646
Add availability check for useDataProtection in test so all platforms…
mdmathias Jan 31, 2024
8610b19
Update indentation for #if os checks
mdmathias Feb 1, 2024
33feab3
Streamline calls to save the AuthSession
mdmathias Feb 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Streamline calls to save the AuthSession
  • Loading branch information
@mdmathias
mdmathias committed Feb 1, 2024
commit 33feab398ba11f15495767e32fd74238e86fcfd7
21 changes: 4 additions & 17 deletions GTMAppAuth/Sources/KeychainStore/KeychainStore.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,22 +101,7 @@ public final class KeychainStore: NSObject, AuthSessionStore {

@objc(saveAuthSession:error:)
public func save(authSession: AuthSession) throws {
mdmathias marked this conversation as resolved.
Show resolved Hide resolved
let authSessionData: Data = try authSessionData(fromAuthSession: authSession)

var maybeAccessibility: CFString? = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
if #available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *) {
#if os(macOS)
if !keychainAttributes.contains(.useDataProtectionKeychain) {
maybeAccessibility = nil
}
#endif
}

try keychainHelper.setPassword(
data: authSessionData,
forService: itemName,
accessibility: maybeAccessibility
)
try save(authSession: authSession, withItemName: itemName)
}

/// Saves the provided `AuthSession` using the provided item name.
Expand All @@ -132,6 +117,8 @@ public final class KeychainStore: NSObject, AuthSessionStore {

var maybeAccessibility: CFString? = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
if #available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *) {
mdmathias marked this conversation as resolved.
Show resolved Hide resolved
// On macOS, we must use `kSecUseDataProtectionKeychain` if using `kSecAttrAccessible`
// (https://developer.apple.com/documentation/security/ksecattraccessible?language=objc)
#if os(macOS)
if !keychainAttributes.contains(.useDataProtectionKeychain) {
maybeAccessibility = nil
Expand Down Expand Up @@ -291,7 +278,7 @@ public final class KeychainStore: NSObject, AuthSessionStore {
}

if #available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *) {
mdmathias marked this conversation as resolved.
Show resolved Hide resolved
// We must use `kSecUseDataProtectionKeychain` if we use a `kSecAttrAccessible` attribute
// On macOS, we must use `kSecUseDataProtectionKeychain` if using `kSecAttrAccessible`
// (https://developer.apple.com/documentation/security/ksecattraccessible?language=objc)
#if os(macOS)
if !keychainAttributes.contains(.useDataProtectionKeychain) {
Expand Down
Loading