Swift Application Security: Top 10 Vulnerabilities for Beginners

Swift Application Security: Top 10 Vulnerabilities for Beginners

Developing mobile and desktop applications in Swift requires not only knowledge of syntax and frameworks, but also an understanding of cybersecurity fundamentals. Even a small mistake in code can lead to user data leakage or device compromise. In this article, we will break down the top 10 common vulnerabilities of Swift applications that beginner developers face, and show how to avoid them.

1. Insecure Data Storage

One of the most common mistakes is saving confidential information (passwords, tokens, API keys) in UserDefaults or in plain text files. This data can be easily extracted on a jailbroken device.

// Incorrect: storing password in UserDefaultsUserDefaults.standard.set("mySecretPassword", forKey: "userPassword")

// Correct: using Keychainimport Securitylet password = "mySecretPassword"let keychainItem = [    kSecClass: kSecClassGenericPassword,    kSecAttrAccount: "userPassword",    kSecValueData: password.data(using: .utf8)!] as CFDictionarySecItemAdd(keychainItem, nil)

2. Injections via SQLite and Core Data

Using raw strings in database queries opens the door for SQL injections. Even if you use Core Data, unsafe predicates can be attacked.

// Incorrect: direct substitutionlet username = "admin' OR '1'='1"let query = "SELECT * FROM users WHERE name = '\\(username)'"

// Correct: using parameterized queries (FMDB)let query = "SELECT * FROM users WHERE name = ?"db.executeQuery(query, withArgumentsIn: [username])

3. Lack of HTTPS and SSL Pinning

Using HTTP instead of HTTPS makes the application vulnerable to man-in-the-middle (MITM) attacks. Even with HTTPS, it is recommended to use SSL Pinning for additional protection.

// Configuring HTTPS in Info.plist// <key>NSAppTransportSecurity</key>// <dict>//     <key>NSAllowsArbitraryLoads</key>//     <false/>// </dict>

// Implementing SSL Pinning with URLSessionlet pinnedKeys = ["yourPublicKeyHash"]let delegate = URLSessionPinningDelegate(pinnedKeys: pinnedKeys)let session = URLSession(configuration: .default, delegate: delegate, delegateQueue: nil)

4. Weak Encryption Algorithms

Using outdated encryption algorithms (MD5, SHA1) or custom cryptographic functions makes data vulnerable. Always use modern libraries.

// Incorrect: MD5let hash = MD5(string: "password")

// Correct: using CommonCrypto with SHA256import CommonCryptofunc sha256(_ data: Data) -> Data {    var hash = [UInt8](repeating: 0, count: Int(CC_SHA256_DIGEST_LENGTH))    data.withUnsafeBytes {        _ = CC_SHA256($0.baseAddress, CC_LONG(data.count), &hash)    }    return Data(hash)}

5. Insufficient Input Validation

Lack of user input validation can lead to XSS attacks (in WebView) or data corruption. Check all input data for length, format, and content.

// Incorrect: trusting inputlet userInput = textField.textwebView.loadHTMLString(userInput!, baseURL: nil)

// Correct: input sanitizationfunc sanitizeInput(_ input: String) -> String {    return input        .replacingOccurrences(of: "&", with: "&")        .replacingOccurrences(of: "<", with: "<")        .replacingOccurrences(of: ">", with: ">")}

6. Data Leakage via Logs and Debugging

Leftover print() or NSLog statements in production can expose confidential data. Use conditional compilation for debug messages.

// Incorrect: logging in production