Skip to content

Feat: disable default iOS URLCache #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: main
Choose a base branch
from

Conversation

Xseuguh
Copy link

@Xseuguh Xseuguh commented Apr 16, 2025

What is the problem

On iOS, each request is cached in plain text within the app’s file system. A malicious user with root access could access this cache and extract sensitive data, such as credentials from a login endpoint.
More details on this article

Proposal

Deactivate the URLCache and clear the existing cache
=> Will it break things ? On react native app, caching is mainly done on the JS side, this native cache does not seem to be used

How to reproduce

  • Launch your app
  • Open the files associated to this app (for example using open $(xcrun simctl get_app_container booted <your.bundle.id> data))
  • Go to Library/Caches/<your.bundle.id>
  • Open the Cache.db
Before After
before.mp4
after.mp4

TODO

Blocking the merge:

  • add a flag to enable/disable the functionality (disable by default)
  • complete README with an Experimental tag

To go further:

  • investigate more deeply the full impact of fully disabling the cache (webview, assets, ...)

@Xseuguh Xseuguh force-pushed the feat/deactivate-ios-url-cache branch from ab7ffe8 to 3d8ca00 Compare April 18, 2025 10:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants