Mobile App Security Best Practices

import AsyncStorage from '@react-native-async-storage/async-storage';
import CryptoJS from 'crypto-js';
import TouchID from 'react-native-touch-id';
import * as Keychain from 'react-native-keychain';

class SecureAuthService {
  constructor() {
    this.tokenKey = 'secure_auth_token';
    this.refreshTokenKey = 'secure_refresh_token';
    this.encryptionKey = 'your-encryption-key'; // Should be dynamically generated
  }

  // Secure token storage using Keychain
  async storeTokenSecurely(token, refreshToken) {
    try {
      // Store in iOS Keychain / Android Keystore
      await Keychain.setCredentials(
        this.tokenKey,
        'user',
        token,
        {
          accessControl: Keychain.ACCESS_CONTROL.BIOMETRY_CURRENT_SET,
          authenticationType: Keychain.AUTHENTICATION_TYPE.DEVICE_PASSCODE_OR_BIOMETRICS,
          accessGroup: 'your.app.bundle.id',
        }
      );
      
      // Encrypt and store refresh token
      const encryptedRefreshToken = CryptoJS.AES.encrypt(
        refreshToken, 
        this.encryptionKey
      ).toString();
      
      await AsyncStorage.setItem(this.refreshTokenKey, encryptedRefreshToken);
      
      return true;
    } catch (error) {
      console.error('Token storage failed:', error);
      return false;
    }
  }

  // Retrieve token with biometric authentication
  async getTokenSecurely() {
    try {
      const credentials = await Keychain.getCredentials(this.tokenKey);
      if (credentials && credentials.password) {
        return credentials.password;
      }
    } catch (error) {
      console.error('Token retrieval failed:', error);
    }
    return null;
  }

  // Multi-factor authentication implementation
  async authenticateWithMFA(username, password, totpCode) {
    try {
      // Step 1: Validate credentials
      const response = await fetch('/api/auth/login', {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          username: this.sanitizeInput(username),
          password, // Should be hashed client-side
          totpCode,
          deviceId: await this.getDeviceId(),
        }),
      });

      if (!response.ok) {
        throw new Error('Authentication failed');
      }

      const authData = await response.json();
      
      // Step 2: Store tokens securely
      await this.storeTokenSecurely(
        authData.accessToken,
        authData.refreshToken
      );
      
      // Step 3: Setup biometric authentication for future logins
      await this.setupBiometricAuth();
      
      return authData;
    } catch (error) {
      console.error('MFA Authentication failed:', error);
      throw error;
    }
  }

  // Biometric authentication setup
  async setupBiometricAuth() {
    try {
      const biometryType = await TouchID.isSupported();
      if (biometryType) {
        // Enable biometric authentication for future logins
        await AsyncStorage.setItem('biometric_enabled', 'true');
        return true;
      }
    } catch (error) {
      console.warn('Biometric setup failed:', error);
    }
    return false;
  }

  // Secure logout with token cleanup
  async logout() {
    try {
      // Revoke tokens on server
      const token = await this.getTokenSecurely();
      if (token) {
        await fetch('/api/auth/logout', {
          method: 'POST',
          headers: {
            'Authorization': `Bearer ${token}`,
          },
        });
      }
      
      // Clear all stored credentials
      await Keychain.resetCredentials(this.tokenKey);
      await AsyncStorage.multiRemove([
        this.refreshTokenKey,
        'biometric_enabled',
        'user_preferences',
      ]);
      
      return true;
    } catch (error) {
      console.error('Logout failed:', error);
      return false;
    }
  }

  // Input sanitization
  sanitizeInput(input) {
    return input.replace(/[<>"'%;()&+]/g, '');
  }

  // Device fingerprinting for additional security
  async getDeviceId() {
    try {
      let deviceId = await AsyncStorage.getItem('device_id');
      if (!deviceId) {
        deviceId = CryptoJS.lib.WordArray.random(16).toString();
        await AsyncStorage.setItem('device_id', deviceId);
      }
      return deviceId;
    } catch (error) {
      console.error('Device ID generation failed:', error);
      return 'unknown';
    }
  }
}

export default SecureAuthService;

import CryptoJS from 'crypto-js';
import * as Keychain from 'react-native-keychain';
import { Platform } from 'react-native';

class DataEncryptionService {
  constructor() {
    this.keyAlias = 'app_master_key';
  }

  // Generate or retrieve master encryption key
  async getMasterKey() {
    try {
      // Check if key exists in secure storage
      const credentials = await Keychain.getCredentials(this.keyAlias);
      
      if (credentials && credentials.password) {
        return credentials.password;
      } else {
        // Generate new master key
        const masterKey = CryptoJS.lib.WordArray.random(256/8).toString();
        
        await Keychain.setCredentials(
          this.keyAlias,
          'master',
          masterKey,
          {
            accessControl: Platform.OS === 'ios' 
              ? Keychain.ACCESS_CONTROL.WHEN_UNLOCKED_THIS_DEVICE_ONLY
              : Keychain.ACCESS_CONTROL.WHEN_UNLOCKED,
            storage: Keychain.STORAGE_TYPE.RSA,
          }
        );
        
        return masterKey;
      }
    } catch (error) {
      console.error('Master key generation failed:', error);
      throw new Error('Encryption key unavailable');
    }
  }

  // Encrypt sensitive data
  async encryptData(data, additionalKey = null) {
    try {
      const masterKey = await this.getMasterKey();
      const encryptionKey = additionalKey 
        ? CryptoJS.PBKDF2(masterKey + additionalKey, 'salt', { keySize: 256/32 })
        : masterKey;
      
      const encrypted = CryptoJS.AES.encrypt(
        JSON.stringify(data), 
        encryptionKey
      ).toString();
      
      // Add integrity check
      const hash = CryptoJS.SHA256(encrypted).toString();
      
      return {
        data: encrypted,
        hash: hash,
        timestamp: Date.now(),
      };
    } catch (error) {
      console.error('Data encryption failed:', error);
      throw error;
    }
  }

  // Decrypt sensitive data with integrity verification
  async decryptData(encryptedPackage, additionalKey = null) {
    try {
      const { data, hash, timestamp } = encryptedPackage;
      
      // Verify data integrity
      const computedHash = CryptoJS.SHA256(data).toString();
      if (computedHash !== hash) {
        throw new Error('Data integrity check failed');
      }
      
      const masterKey = await this.getMasterKey();
      const decryptionKey = additionalKey 
        ? CryptoJS.PBKDF2(masterKey + additionalKey, 'salt', { keySize: 256/32 })
        : masterKey;
      
      const decryptedBytes = CryptoJS.AES.decrypt(data, decryptionKey);
      const decryptedData = decryptedBytes.toString(CryptoJS.enc.Utf8);
      
      return JSON.parse(decryptedData);
    } catch (error) {
      console.error('Data decryption failed:', error);
      throw error;
    }
  }

  // Secure file encryption for local storage
  async encryptFile(fileData) {
    try {
      const masterKey = await this.getMasterKey();
      
      // Generate file-specific key
      const fileKey = CryptoJS.PBKDF2(
        masterKey, 
        CryptoJS.lib.WordArray.random(128/8), 
        { keySize: 256/32, iterations: 10000 }
      );
      
      // Encrypt file data in chunks for large files
      const chunkSize = 1024 * 64; // 64KB chunks
      const chunks = [];
      
      for (let i = 0; i < fileData.length; i += chunkSize) {
        const chunk = fileData.slice(i, i + chunkSize);
        const encryptedChunk = CryptoJS.AES.encrypt(chunk, fileKey).toString();
        chunks.push(encryptedChunk);
      }
      
      return {
        chunks: chunks,
        key: fileKey.toString(),
        metadata: {
          originalSize: fileData.length,
          chunkCount: chunks.length,
          timestamp: Date.now(),
        }
      };
    } catch (error) {
      console.error('File encryption failed:', error);
      throw error;
    }
  }

  // Database field encryption
  async encryptDatabaseField(fieldValue, fieldName) {
    try {
      // Use field-specific encryption key
      const fieldKey = CryptoJS.PBKDF2(
        await this.getMasterKey() + fieldName,
        'field_salt',
        { keySize: 256/32 }
      );
      
      return CryptoJS.AES.encrypt(fieldValue, fieldKey).toString();
    } catch (error) {
      console.error('Database field encryption failed:', error);
      throw error;
    }
  }

  // Key rotation for enhanced security
  async rotateEncryptionKey() {
    try {
      // Generate new master key
      const newMasterKey = CryptoJS.lib.WordArray.random(256/8).toString();
      
      // Store old key temporarily for data migration
      const oldKey = await this.getMasterKey();
      
      // Update master key
      await Keychain.setCredentials(
        this.keyAlias,
        'master',
        newMasterKey,
        {
          accessControl: Platform.OS === 'ios' 
            ? Keychain.ACCESS_CONTROL.WHEN_UNLOCKED_THIS_DEVICE_ONLY
            : Keychain.ACCESS_CONTROL.WHEN_UNLOCKED,
        }
      );
      
      return {
        success: true,
        oldKey: oldKey, // Use for re-encrypting existing data
        newKey: newMasterKey,
      };
    } catch (error) {
      console.error('Key rotation failed:', error);
      throw error;
    }
  }
}

export default DataEncryptionService;

import CryptoJS from 'crypto-js';
import { NetworkingModule } from 'react-native';

class SecureNetworkService {
  constructor(baseURL, apiKey) {
    this.baseURL = baseURL;
    this.apiKey = apiKey;
    this.requestCount = 0;
    this.lastRequestTime = 0;
  }

  // Certificate pinning implementation
  async setupCertificatePinning() {
    // Configure certificate pinning for production
    const pinnedCertificates = {
      'api.yourapp.com': [
        'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', // Primary cert
        'sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=', // Backup cert
      ],
    };
    
    return pinnedCertificates;
  }

  // Request signing for API integrity
  signRequest(method, url, body, timestamp) {
    const payload = `${method}${url}${body || ''}${timestamp}`;
    return CryptoJS.HmacSHA256(payload, this.apiKey).toString();
  }

  // Rate limiting implementation
  checkRateLimit() {
    const now = Date.now();
    const timeWindow = 60000; // 1 minute window
    const maxRequests = 100; // Max 100 requests per minute
    
    if (now - this.lastRequestTime > timeWindow) {
      this.requestCount = 0;
      this.lastRequestTime = now;
    }
    
    if (this.requestCount >= maxRequests) {
      throw new Error('Rate limit exceeded');
    }
    
    this.requestCount++;
    return true;
  }

  // Secure API request with multiple protection layers
  async secureRequest(endpoint, options = {}) {
    try {
      // Rate limiting check
      this.checkRateLimit();
      
      const timestamp = Date.now().toString();
      const method = options.method || 'GET';
      const body = options.body ? JSON.stringify(options.body) : '';
      
      // Generate request signature
      const signature = this.signRequest(method, endpoint, body, timestamp);
      
      // Add security headers
      const secureHeaders = {
        'Content-Type': 'application/json',
        'X-API-Key': this.apiKey,
        'X-Timestamp': timestamp,
        'X-Signature': signature,
        'X-App-Version': '1.0.0', // For API versioning
        'User-Agent': 'YourApp/1.0.0', // Prevent generic user agents
        ...options.headers,
      };
      
      // Request timeout configuration
      const controller = new AbortController();
      const timeoutId = setTimeout(() => controller.abort(), 10000);
      
      const response = await fetch(`${this.baseURL}${endpoint}`, {
        method,
        headers: secureHeaders,
        body: body || undefined,
        signal: controller.signal,
        // Additional security options
        credentials: 'omit', // Don't send cookies
        referrerPolicy: 'no-referrer',
      });
      
      clearTimeout(timeoutId);
      
      // Verify response integrity
      if (!response.ok) {
        throw new Error(`HTTP ${response.status}: ${response.statusText}`);
      }
      
      // Check response signature if provided
      const responseSignature = response.headers.get('X-Response-Signature');
      if (responseSignature) {
        const responseBody = await response.text();
        const expectedSignature = CryptoJS.HmacSHA256(
          responseBody, 
          this.apiKey
        ).toString();
        
        if (responseSignature !== expectedSignature) {
          throw new Error('Response integrity check failed');
        }
        
        return JSON.parse(responseBody);
      }
      
      return await response.json();
    } catch (error) {
      console.error('Secure request failed:', error);
      throw error;
    }
  }

  // Token refresh with security measures
  async refreshAuthToken(refreshToken) {
    try {
      const response = await this.secureRequest('/auth/refresh', {
        method: 'POST',
        body: {
          refreshToken,
          deviceFingerprint: await this.getDeviceFingerprint(),
        },
      });
      
      return response;
    } catch (error) {
      console.error('Token refresh failed:', error);
      throw error;
    }
  }

  // Device fingerprinting for additional security
  async getDeviceFingerprint() {
    // Collect device characteristics for fingerprinting
    const { width, height } = Dimensions.get('screen');
    const deviceInfo = {
      platform: Platform.OS,
      version: Platform.Version,
      screenWidth: width,
      screenHeight: height,
      // Add more device characteristics as needed
    };
    
    return CryptoJS.SHA256(JSON.stringify(deviceInfo)).toString();
  }
}

export default SecureNetworkService;

import { Platform, NativeModules } from 'react-native';
import DeviceInfo from 'react-native-device-info';

class RuntimeProtectionService {
  constructor() {
    this.isDebugMode = __DEV__;
    this.integrityChecks = [];
    this.initializeProtection();
  }

  async initializeProtection() {
    // Initialize all protection mechanisms
    await Promise.all([
      this.detectDebugging(),
      this.detectJailbreakRoot(),
      this.detectHooking(),
      this.verifyAppIntegrity(),
    ]);
  }

  // Detect debugging attempts
  async detectDebugging() {
    if (this.isDebugMode) return; // Skip in development
    
    try {
      // Check for debugger attachment
      const isDebuggable = await DeviceInfo.isDebuggingEnabled();
      
      if (isDebuggable) {
        this.triggerSecurityResponse('debugging_detected');
      }
      
      // Additional debugging detection
      const startTime = Date.now();
      debugger; // This will cause delay if debugger is attached
      const endTime = Date.now();
      
      if (endTime - startTime > 100) { // Threshold for debugger detection
        this.triggerSecurityResponse('debugger_attached');
      }
    } catch (error) {
      console.warn('Debug detection failed:', error);
    }
  }

  // Detect jailbreak/root
  async detectJailbreakRoot() {
    try {
      const isJailbroken = await DeviceInfo.isJailBroken();
      
      if (isJailbroken) {
        this.triggerSecurityResponse('device_compromised');
        return true;
      }
      
      // Additional root detection methods
      if (Platform.OS === 'android') {
        const suspiciousApps = [
          'com.noshufou.android.su',
          'com.thirdparty.superuser',
          'eu.chainfire.supersu',
          'com.koushikdutta.superuser',
        ];
        
        // Check for root apps (implementation depends on native modules)
        // This would require custom native module implementation
      }
      
      return false;
    } catch (error) {
      console.warn('Jailbreak detection failed:', error);
      return false;
    }
  }

  // Detect runtime manipulation/hooking
  detectHooking() {
    try {
      // Check for common hooking frameworks
      const originalFetch = fetch;
      const originalConsoleLog = console.log;
      
      // Monitor for function replacement
      setTimeout(() => {
        if (fetch !== originalFetch) {
          this.triggerSecurityResponse('fetch_hooked');
        }
        
        if (console.log !== originalConsoleLog) {
          this.triggerSecurityResponse('console_hooked');
        }
      }, 1000);
      
      // Stack trace analysis for hooking detection
      const stack = new Error().stack;
      if (stack && this.containsSuspiciousFrameworks(stack)) {
        this.triggerSecurityResponse('hooking_framework_detected');
      }
    } catch (error) {
      console.warn('Hooking detection failed:', error);
    }
  }

  // App integrity verification
  async verifyAppIntegrity() {
    try {
      // Bundle hash verification (requires build-time hash generation)
      const expectedHash = 'your_bundle_hash_here'; // Set during build
      
      // This would require native module to calculate actual bundle hash
      // const actualHash = await NativeModules.IntegrityChecker.getBundleHash();
      
      // if (actualHash !== expectedHash) {
      //   this.triggerSecurityResponse('app_tampered');
      // }
      
      // Check for suspicious modifications
      if (await this.detectRepackaging()) {
        this.triggerSecurityResponse('app_repackaged');
      }
    } catch (error) {
      console.warn('Integrity verification failed:', error);
    }
  }

  // Detect app repackaging
  async detectRepackaging() {
    try {
      const packageName = await DeviceInfo.getBundleId();
      const expectedPackageName = 'com.yourcompany.yourapp';
      
      if (packageName !== expectedPackageName) {
        return true;
      }
      
      // Check signing certificate (requires native implementation)
      // const signingCert = await NativeModules.IntegrityChecker.getSigningCert();
      // const expectedCert = 'your_expected_cert_hash';
      
      // return signingCert !== expectedCert;
      
      return false;
    } catch (error) {
      console.warn('Repackaging detection failed:', error);
      return false;
    }
  }

  // Check for suspicious frameworks in stack trace
  containsSuspiciousFrameworks(stack) {
    const suspiciousPatterns = [
      'frida',
      'xposed',
      'substrate',
      'cycript',
    ];
    
    return suspiciousPatterns.some(pattern => 
      stack.toLowerCase().includes(pattern)
    );
  }

  // Security response actions
  triggerSecurityResponse(threatType) {
    console.warn(`Security threat detected: ${threatType}`);
    
    switch (threatType) {
      case 'device_compromised':
      case 'app_tampered':
      case 'app_repackaged':
        // Critical threats - terminate app
        this.terminateApp('Critical security threat detected');
        break;
        
      case 'debugging_detected':
      case 'debugger_attached':
      case 'hooking_framework_detected':
        // Moderate threats - log and potentially limit functionality
        this.logSecurityEvent(threatType);
        this.enableRestrictedMode();
        break;
        
      default:
        this.logSecurityEvent(threatType);
    }
  }

  // Log security events for analysis
  logSecurityEvent(eventType) {
    const securityEvent = {
      type: eventType,
      timestamp: Date.now(),
      deviceInfo: {
        platform: Platform.OS,
        version: Platform.Version,
      },
    };
    
    // Send to security monitoring service
    // this.sendSecurityLog(securityEvent);
  }

  // Enable restricted mode
  enableRestrictedMode() {
    // Disable sensitive features
    console.warn('App running in restricted mode due to security concerns');
    // Implementation depends on app architecture
  }

  // Terminate app for critical threats
  terminateApp(reason) {
    console.error(`App terminating: ${reason}`);
    // Implement app termination logic
    // This might involve showing a security warning and closing the app
  }
}

export default RuntimeProtectionService;