CODEWITHSUNDEEP
flutterxcodefirebase-cloud-messagingappdelegateipa
Danish Ghazi
Danish Ghazi

Reputation: 79

Xcode: Hide GoogleService-Info.plist when Building IPA iOS

Im new to Flutter and iOS, and Im currently building a Flutter IOS with Firebase Cloud Messaging integrated into the application. I have a GoogleService-Info.plist for two flavors (UAT and Production) in my Xcode Runner project. However, during a recent penetration testing, one of the findings is the penetration tester could see the API Key in the GoogleService-Info.plist from built the IPA file. Is there any way I can hide the GoogleService-Info.plist so no one can see the GoogleService-Info.plist contents after I built the IPA file? Attached is screenshot of the file structure of the Xcode runner:

enter image description here

Upvotes: 1

Views: 77

Answers (1)

Duy Tran
Duy Tran

Reputation: 1167

Typically there is no way to do it

But I think Google still uses this approach because actually, this file doesn't need to be secured, see the image attached below

enter image description here

So if someone can get it, no security leak -> no need to worry about this file

More details https://firebase.google.com/docs/projects/api-keys

If you would like to have more secure on firebase data access, refer to https://firebase.google.com/docs/projects/api-keys#apply-restrictions

Upvotes: 1

Related Questions