PH07893: IOS DEVICE LOGS SHOW SENSITIVE DATA LIKE ADAPTER RESPONSES AND ACCESS TOKENS IN DEVICE LOGS

APAR status

• Closed as program error.

Error description

• Product components impacted: SDK
  Affected mobile development environments: Hybrid
  Mobile Devices Operating Systems impacted: iOS
  User roles impacted: Developer
  Distribution: Fix Central
  Versions affected: 7.1
  iOS application running in release mode shows sensitive data
   like adapter responses and access tokens in device logs
  

Local fix

• MobileFirst SDK v7.1 by default is built with log level as
  debug. So unless a developer explicitly use OCLogger setLevel
  API to set it to
  Error or FATAL, by default the app using MFP print responses
  from the MobileFirst server.
  You  should make use of following API to prevent debug
  information getting printed on device in release mode.
  [OCLogger setLevel:OCLogger_ERROR];
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Developers of MobileFirst apps on iOS native & Hybrid        *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Potentially sensitive data such as adapter responses are     *
  * printed in the device logs on iOS. This is because the       *
  * server responses are logged in debug mode and the            *
  * MobileFirst SDK prints all debug statements by default       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The MobileFirst SDK was modified to prevent logging of
  potentially sensitive information even in debug mode.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MOBILE1ST PF EN

• Fixed component ID

  5725I4300

Applicable component levels