Package com.codename1.security.shield

package com.codename1.security.shield

API shielding: attestation tokens, over-the-air certificate pinning, and runtime self-protection reporting.

Start at AppShield.

What this can and cannot do

Worth being precise about, because the category attracts overclaiming. On a device the attacker fully controls, no client-side check is unbypassable -- detection code can be patched out and headers can be stripped. What this buys you is threefold:

  1. Your backend gets a cryptographically verifiable statement from Apple or Google about the app and device, evaluated by a service the attacker does not control. That is a categorically different thing from a boolean your own app computed about itself.
  2. The cost of scripted abuse rises from "reproduce the API calls with a shell script" to "reverse-engineer and re-sign a native binary, per release".
  3. Certificate pins rotate over the air, so a pin change no longer needs an app store release -- which is what makes pinning practical to run at all.

It does not make an app unhackable, and any product in this space that says otherwise is selling something.

The load-bearing part is on your server

The token means nothing until your backend refuses to serve requests without a valid one. Until that check exists, adding the shield changes nothing about your security.

  • Class
    Description
    AppShield
    API shielding: proves to your own backend that a request came from a genuine, unmodified build of your app running on a device that has not been tampered with.
    FailureMode
    What a protected host should do when a token cannot be obtained.
    HostPolicy
    What the shield does for a given host: whether to attach an attestation token, whether to enforce certificate pins, and what to do when a token cannot be obtained.
    PinSet
    An immutable set of certificate pins, keyed by host, as published by the attestation service.
    ShieldConfig
    Configuration for AppShield.init(ShieldConfig).
    ShieldException
    Raised when a shield operation cannot produce a usable token, or when a request to a protected host is refused because its certificate chain matched no configured pin.
    ShieldListener
    Callback for shield state changes.
    ShieldSignal
    One runtime self-protection observation, such as "a hooking framework is loaded".
    ShieldSignals
    Collection point for runtime self-protection observations.
    ShieldStatus
    Outcome of a shield operation.
    ShieldToken
    A short-lived attestation token, ready to be attached to a request.