Implementing Security Best Practices

import SInfo from 'react-native-sensitive-info';

// Store sensitive data
await SInfo.setItem('authToken', 'abc123xyz', {
  sharedPreferencesName: 'mySharedPrefs',
  keychainService: 'myKeychain',
});

// Retrieve sensitive data
const token = await SInfo.getItem('authToken', {
  sharedPreferencesName: 'mySharedPrefs',
  keychainService: 'myKeychain',
});

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>NSAppTransportSecurity</key>
    <dict>
      <key>NSExceptionDomains</key>
      <dict>
        <key>api.example.com</key>
        <dict>
          <key>NSExceptionAllowsInsecureHTTPLoads</key>
          <false/>
          <key>NSExceptionRequiresForwardSecrecy</key>
          <true/>
          <key>NSExceptionMinimumTLSVersion</key>
          <string>TLSv1.2</string>
          <key>NSPinnedCertificates</key>
          <array>
            <data>MIIE...</data>
          </array>
        </dict>
      </dict>
    </dict>
  </dict>
</plist>

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
  <domain-config>
    <domain includeSubdomains="true">api.example.com</domain>
    <pin-set expiration="2025-12-31">
      <pin digest="SHA-256">MIIE...</pin>
    &pin-set>
  </domain-config>
</network-security-config>

// Before obfuscation
const secretKey = 'mySecretKey';
function authenticateUser(username, password) {
    if (username === 'admin' && password === secretKey) {
        return true;
    }
    return false;
}

// After obfuscation (simplified)
var _0x123456 = ['secretKey', 'authenticateUser'];
(function (_0x123457, _0x123458) {
    var _0x123459 = _0x123456[_0x123458];
    return _0x123459;
}(_0x123456, 0));
function _0x12345a(_0x12345b, _0x12345c) {
    var _0x12345d = _0x123456[1];
    if (_0x12345b === 'admin' && _0x12345c === _0x123456[0]) {
        return true;
    }
    return false;
}

import { Platform } from 'react-native';

const isDebugging = () => {
  if (Platform.OS === 'android') {
    return __DEV__ || false;
  }
  return __DEV__ || false;
};

if (isDebugging()) {
  console.warn('App is running in debug mode');
}

import { authenticate } from 'react-native-local-authentication';

const handleBiometricAuth = async () => {
  try {
    const success = await authenticate({
      promptMessage: 'Authenticate to access the app',
      cancelMessage: 'Cancel',
      fallbackMessage: 'Use passcode'
    });
    
    if (success) {
      console.log('Authentication successful');
    } else {
      console.log('Authentication failed');
    }
  } catch (error) {
    console.error('Error during authentication:', error);
  }
};

const apiCall = async () => {
  const response = await fetch("https://api.example.com/data", {
    method: "GET",
    headers: {
      "Content-Type": "application/json"
    }
  });
  return response.json();
};

import Foundation

func urlSessionDidReceiveChallenge(
  session: URLSession,
  challenge: URLAuthenticationChallenge
) -> (URLSession.AuthChallengeDisposition, URL?) {
  guard let serverTrust = challenge.protectionSpace.serverTrust else {
    return (.cancelAuthenticationChallenge, nil)
  }

  let pinnedCertificates = [/* Add certificate hashes here */]
  let isTrusted = pinnedCertificates.contains { certHash in
    // Compare certificate hash with known good ones
    return true // Placeholder logic
  }

  if isTrusted {
    return (.useCredential, URLCredential(trust: serverTrust))
  } else {
    return (.cancelAuthenticationChallenge, nil)
  }
}

const validateEmail = (email) => {
  const re = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return re.test(email);
};

console.log(validateEmail('user@example.com')); // true

import intlTelInput from 'intl-tel-input';

const phoneInput = document.getElementById('phone');
intlTelInput(phoneInput, {
  utilsScript: 'https://cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.8/js/utils.js'
});

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>NSAppTransportSecurity</key>
    <dict>
      <key>NSAllowsArbitraryLoadsInWebContent</key>
      <false/>
      <key>NSAllowsLocalNetworking</key>
      <true/>
      <key>NSExceptionDomains</key>
      <dict>
        <key>staging.example.com</key>
        <dict>
          <key>NSExceptionAllowsInsecureHTTPLoads</key>
          <true/>
        </dict>
      </dict>
    </dict>
  </dict>
</plist>

import { preventScreenshot } from 'react-native-screenshot-prevention';

preventScreenshot(true); // Enable screenshot prevention

-keep class com.example.reactnative.** { *; }
-keepclassmembers class com.example.reactnative.** {
    <init>(android.content.Context, android.util.AttributeSet);
}

android {
    buildTypes {
        release {
            minifyEnabled true
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }
}

import { Platform } from 'react-native';

const isJailbroken = () => {
  // Check for common jailbreak indicators
  if (Platform.OS === 'android') {
    return (
      // Check for root flags
      process.execSync('ls /system/bin/su', { stdio: 'ignore' })
      .status === 0
    );
  } else {
    // For iOS, check for越狱 indicators
    return (
      process.execSync('ls /Applications/Blackra1n.app', { stdio: 'ignore' })
      .status === 0
    );
  }
};

export { isJailbroken };