iOS 应用关于弥补安全优化问题
1.log输出会被中奖者截获，暴露信息，影响app得性能
在工程里面的pch文件加入以下代码
// 调试状态
#define LMLog(...) NSLog(__VA_ARGS__)
#else
// 发布状态
#define LMLog(...)
#endif /* PersonLife_pch */
#ifdef DEBUG
#define NSLog(...) NSLog(__VA_ARGS__)
#define debugMethod() NSLog(@"%s", __func__)
#else
#define NSLog(...)
#define debugMethod()
然后在工程里面写product---scheme,编辑成release
调试开发阶段编辑成debug模式 进行调试开发
2.登录请求最好用post请求，把用户信息放在请求体里面更加安全
如果是H5的登录页做登录的，则需要后台把前端用到的参数拼在get请求后面，在H5后面MD5加密在拼在get请求的后面的参数，更加安全
3.做代码混淆
提高代码的安全性，使代码变得难读，推荐使用ZMConfuse，在github上可搜索到
使用方法：在终端 cd + ZMConfus ,把混淆的工程拷贝到当前目录下，根据需求修改.sh文件
再次打开工程，会报一些错误 ，修改pch的路径就好，在终端拖入终端，点回车即可 执行脚本命令
再次打开工程，就出现混淆的代码，对类，属性，方法，函数进行混淆，是代码完全失去了可读性。
（注意文件名和类的命名的规则，需注意如一样找不到对应的错误，会报编译错误，造成混淆错误）
4.使用新设备时需要进行验证授权 ---如微信
不同设备重复登录校验问题 ：第一次登录账号绑定设备uuid，用第二部手机时再次登录同一账号时，服务器首先比较uuid uuid 不同注销当前掉当前的用户 弹出alert 用手机验证码进行验证，验证成功绑定uuid，实现微信号一对多的存储在服务端后台中实现账号登录 以此类推，实现不同设备重复登录校验。
5.https的双重验证问题 需要后台提供相关的证书进行认证即可
这里是系统验证的方法
- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge {
//直接验证服务器是否被认证（serverTrust），这种方式直接忽略证书验证，信任该connect
SecTrustRef serverTrust = [[challenge protectionSpace] serverTrust];
return [[challenge sender] useCredential: [NSURLCredential credentialForTrust: serverTrust]
forAuthenticationChallenge: challenge];
if ([[[challenge protectionSpace] authenticationMethod] isEqualToString: NSURLAuthenticationMethodServerTrust]) {
do
{
SecTrustRef serverTrust = [[challenge protectionSpace] serverTrust];
NSCAssert(serverTrust != nil, @"serverTrust is nil");
if(nil == serverTrust)
break; /* failed */
NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"证书名称" ofType:@"cer"];//自签名证书
NSData* caCert = [NSData dataWithContentsOfFile:cerPath];
NSString *cerPath2 = [[NSBundle mainBundle] pathForResource:@"证书名称" ofType:@"cer"];//SSL证书
NSData * caCert2 = [NSData dataWithContentsOfFile:cerPath2];
NSCAssert(caCert != nil, @"caCert is nil");
if(nil == caCert)
break; /* failed */
NSCAssert(caCert2 != nil, @"caCert2 is nil");
if (nil == caCert2) {
break;
}
SecCertificateRef caRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)caCert);
NSCAssert(caRef != nil, @"caRef is nil");
if(nil == caRef)
break; /* failed */
SecCertificateRef caRef2 = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)caCert2);
NSCAssert(caRef2 != nil, @"caRef2 is nil");
if(nil == caRef2)
break; /* failed */
NSArray *caArray = @[(__bridge id)(caRef),(__bridge id)(caRef2)];
NSCAssert(caArray != nil, @"caArray is nil");
if(nil == caArray)
break; /* failed */
OSStatus status = SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)caArray);
NSCAssert(errSecSuccess == status, @"SecTrustSetAnchorCertificates failed");
if(!(errSecSuccess == status))
break; /* failed */
SecTrustResultType result = -1;
status = SecTrustEvaluate(serverTrust, &result);
if(!(errSecSuccess == status))
break; /* failed */
NSLog(@"stutas:%d",(int)status);
NSLog(@"Result: %d", result);
BOOL allowConnect = (result == kSecTrustResultUnspecified) || (result == kSecTrustResultProceed);
if (allowConnect) {
NSLog(@"success");
}else {
NSLog(@"error");
}
if(! allowConnect)
{
break; /* failed */
}
#if 0
/* Treat kSecTrustResultConfirm and kSecTrustResultRecoverableTrustFailure as success */
/* since the user will likely tap-through to see the dancing bunnies */
if(result == kSecTrustResultDeny || result == kSecTrustResultFatalTrustFailure || result == kSecTrustResultOtherError)
break; /* failed to trust cert (good in this case) */
#endif
// The only good exit point
NSLog(@"信任该证书");
return [[challenge sender] useCredential: [NSURLCredential credentialForTrust: serverTrust]
forAuthenticationChallenge: challenge];
}
while(0);
}
// Bad dog
return [[challenge sender] cancelAuthenticationChallenge: challenge];
}
- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace {
return [protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust];
}
//目前APP检测遇到这些问题，已解决 希望有所能对你帮助 共勉
