本文是小编为大家收集整理的关于在iOS应用程序中使用的API密钥和秘密--将它们存储在哪里？的处理/解决方法，可以参考本文帮助大家快速定位并解决问题，中文翻译不准确的可切换到English标签页查看源文。
问题描述
我正在为iOS开发，我需要使用API密钥和秘密向某些API提出请求.但是，我不希望将其暴露在我的源代码中，并在我推到存储库时将秘密妥协.
这种情况的最佳实践是什么?将其写在一个单独的文件中，该文件将包含在.gitignore中?
谢谢
推荐答案
将其写在一个单独的文件中，我将在.gitignore中包含吗?
不，不要写它.
这意味着:
- 您不会在您的存储库中写下该秘密(不需要gitignore，或者担心添加/承诺/推动它错误) )
- 您不在本地驱动器上的任何地方写(不必担心您的计算机上被偷走的"秘密")
存储在您的存储库中，可以从外部来源(从git repo之外)寻求该秘密并将其加载到内存中.
这类似于 git credential-helper process ，该脚本将启动聆听localhost:port的过程以服务以服务每当您仅在当前会话中需要时，您就会对您进行"秘密".
会话完成后，就不会剩下跟踪.
这是管理秘密数据的最佳实践.
如果您在.gitattributes文件中将其声明为内容过滤器，则可以自动触发该脚本:
其他推荐答案
这是一个非常古老的问题，但是如果有人在Google中看到此问题，我建议您尝试存储任何应用程序秘密(API Keys，Oauth Secrets).只有您的应用程序才能访问您的应用程序容器，并且Apple和您的应用程序之间的通信是安全的. 您可以检查一下在这里.
问题描述
I'm developing for iOS and I need to make requests to certain APIs using an API key and a secret. However, I wouldn't like for it to be exposed in my source code and have the secret compromised when I push to my repository.
What is the best practice for this case? Write it in a separate file which I'll include in .gitignore?
Thanks
推荐答案
Write it in a separate file which I'll include in .gitignore?
No, don't write it ever.
That means:
- you don't write that secret within your repo (no need to gitignore it, or ot worry about adding/committing/pushing it by mistake)
- you don't write it anywhere on your local drive (no need to worry about your computer stolen with that "secret" on it)
Store in your repo a script able to seek that secret from an external source (from outside of git repo) and load it in memory.
This is similar to a git credential-helper process, and that script would launch a process listening to localhost:port in order to serve that "secret" to you when you whenever you need it in the current session only.
Once the session is done, there is no trace left.
And that is the best practice to manage secret data.
You can trigger automatically that script on git checkout, if you declare it in a .gitattributes file as a content filter:
其他推荐答案
This is a very old question, but if anyone is seeing this in google I would suggest you try CloudKit for storing any App secrets (API keys, Oauth secrets). Only your app can access your app container and communication between Apple and your app is secure. You can check it out here.
更多相关问答
联系站长