Prepwork for EKM integration #395
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| // | ||
| // DecryptedPrivateKey.swift | ||
| // FlowCrypt | ||
| // | ||
| // Created by Yevhen Kyivskyi on 16.07.2021. | ||
| // Copyright © 2021 FlowCrypt Limited. All rights reserved. | ||
| // | ||
|
|
||
| import Foundation | ||
|
|
||
| struct DecryptedPrivateKeysResponse: Decodable { | ||
|
|
||
| let privateKeys: [DecryptedPrivateKey] | ||
|
|
||
| static let empty = DecryptedPrivateKeysResponse(privateKeys: []) | ||
| } | ||
|
|
||
| struct DecryptedPrivateKey: Decodable { | ||
|
|
||
| let decryptedPrivateKey: String | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,7 +28,8 @@ extension URLSession { | |
| let status = res?.statusCode ?? GeneralConstants.Global.generalError | ||
| let urlMethod = urlRequest.httpMethod ?? "GET" | ||
| let urlString = urlRequest.url?.absoluteString ?? "??" | ||
| let headers = urlRequest.allHTTPHeaderFields ?? [:] | ||
| let message = "URLSession.call status:\(status) ms:\(trace.finish()) \(urlMethod) \(urlString), headers: \(headers)" | ||
|
Collaborator
There was a problem hiding this comment. I wonder if printing request headers here would leak user credentials somewhere dangerous. @martgil is this a problem on iOS?
Contributor
Author
There was a problem hiding this comment. There should not be any printing on production build, we need to check that in our Logger.
Collaborator
There was a problem hiding this comment. I would highly suggest getting rid of the debug information on a production build. Printing the request headers alone even it contains sensitive information isn't a threat yet. An attacker needs physical access or required a network listener to exploit it. Nevertheless, @ekievsky is correct that there shouldn't be any debug logs on the production build.
Collaborator
There was a problem hiding this comment. @ekievsky by "should not be printing" did you mean it does not print any in production build, or that it would be bad if it printed? We'll have to be very clear about this - I'm making an issue to verify that it in fact does not print it in a production build. |
||
| Logger.nested("URLSession").logInfo(message) | ||
|
|
||
| let validStatusCode = 200 ... 299 | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.