You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
freeRASP needs to have access to the maven repository containing freeRASP. Add following lines into the `android/build.gradle` file, in the `allprojects.repositories` section:
_All dependencies of freeRASP for Android are resolved automatically._
105
91
106
92
### iOS
107
93
108
94
freeRASP React Native plugin uses Pods. Navigate to the `ios` folder and run:
109
95
110
96
$ pod install
111
97
112
-
## Step 3: Dev vs Release version
113
-
114
-
The Dev version is used to not complicate the development process of the application, e.g. if you would implement killing of the application on the debugger callback. It disables some checks which won't be triggered during the development process:
115
-
116
-
- Emulator-usage (simulator)
117
-
- Debugging (debug)
118
-
- Signing (appIntegrity)
119
-
- Unofficial store (unofficialStore)
120
-
121
-
Which version of freeRASP is used is tied to the application's development stage - more precisely, how the application is compiled.
122
-
123
-
### Android
124
-
125
-
Android implementation of the React Native plugin detects selected development stage and automatically applies the suitable version of the library.
126
-
127
-
-`npx react-native run-android` (debug) -> uses dev version of freeRASP
128
-
-`npx react-native run-android --variant release` (release) -> uses release version of freeRASP
129
-
130
-
### iOS
131
-
132
-
For the iOS implemtation, it's neccesary to add script into the Xcode environment, that automatically switches between the library dev/release versions according to selected development stage. Then, it is necessary to embedd a symlink to correct TalsecRuntime.xcframework.
133
-
134
-
1. Add pre-built script for changing the Debug and Release versions of the framework:
135
-
- Open up the **.xcworkspace** file
136
-
- Go to **Product** -> **Scheme** -> **Edit Scheme...** -> **Build (dropdown arrow)** -> **Pre-actions**
137
-
- Hit **+** and then **New Run Script Action**
138
-
- Set **Provide build setting from** to your application
- `npx react-native run-ios` (debug) -> uses dev version of freeRASP
161
-
- `npx react-native run-ios --configuration Release` (release) -> uses release version of freeRASP
162
-
163
-
## Step 4: Import freeRASP into the app
98
+
## Step 3: Import freeRASP into the app
164
99
165
100
We provide a custom hook that handles all required logic as registration of freeRASP, mounting and unmounting of listeners for you. Import the hook into your app:
## Step 5: Setup the configuration, callbacks and initialize freeRASP
106
+
## Step 4: Setup the configuration, callbacks and initialize freeRASP
172
107
173
-
First, the configuration and callbacks will be explained. Then the **Initialization** chapter shows the implementation.
108
+
First, the configuration and callbacks will be explained. Then the [Initialization](#initialization) chapter shows the implementation.
174
109
175
110
### Configuration
176
111
177
-
You need to provide configuration for freeRASP to work properly and initialize it. The freeRASP configuration contains configs for both Android and iOS. You must fill all the required values for the plugin to work.
178
-
179
-
For Android:
180
-
181
-
- `packageName` - package name of your app you chose when you created it
182
-
- `certificateHashes` - hash of the certificate of the key which was used to sign the application. **Hash which is passed here must be encoded in Base64 form.** If you are not sure how to get your certificate hash, you can check out the guide on our [Github wiki](https://github.com/talsec/Free-RASP-Community/wiki/Getting-your-signing-certificate-hash-of-app). Multiple hashes are supported, e.g. if you are using a different one for the Huawei App Gallery.
183
-
- `supportedAlternativeStores` _(optional)_ - If you publish on the Google Play Store and/or Huawei AppGallery, you **don't have to assign anything** there as those are supported out of the box.
184
-
185
-
For iOS similarly to Android, `appBundleId` and `appTeamId` are required.
186
-
187
-
Lastly, pass a mail address to `watcherMail` to be able to get reports. Mail has a strict form `[email protected]` which is passed as String.
188
-
189
-
### Callbacks
190
-
191
-
freeRASP executes periodical checks when the application is running. Handle the detected threats in the **listeners**. For example, you can log the event, show a window to the user or kill the application. Visit our [wiki](https://github.com/talsec/Free-RASP-Community/wiki/Threat-detection) to learn more details about the performed checks and their importance for app security.
192
-
193
-
### Initialization
194
-
195
-
You should initialize the freeRASP in the entry point to your app, which is usually in `App.jsx` or `App.tsx`. Just copy & paste this code inside your root component / function, then setup the configuration and reactions to listeners:
112
+
You need to provide configuration for freeRASP to work properly and initialize it. The freeRASP configuration is an JavaScript object that contains configs for both Android and iOS, as well as common configuration. You must fill all the required values for the plugin to work. Use the following template to provide configuration to the Talsec plugin. You can find detailed description of the configuration below.
1.`androidConfig`_: object | undefined_ - required for Android devices, has following keys:
134
+
135
+
-`packageName`_: string_ - package name of your app you chose when you created it
136
+
-`certificateHashes`_: string[]_ - hash of the certificate of the key which was used to sign the application. **Hash which is passed here must be encoded in Base64 form.** If you are not sure how to get your certificate hash, you can check out the guide on our [Github wiki](https://github.com/talsec/Free-RASP-Community/wiki/Getting-your-signing-certificate-hash-of-app). Multiple hashes are supported, e.g. if you are using a different one for the Huawei App Gallery.
137
+
-`supportedAlternativeStores`_: string[] | undefined_ - If you publish on the Google Play Store and/or Huawei AppGallery, you **don't have to assign anything** there as those are supported out of the box.
138
+
139
+
1.`iosConfig`_: object | undefined_ - required for iOS devices, has following keys:
140
+
-`appBundleId`_: string_ - Bundle ID of your app
141
+
-`appTeamId`_: string_ - the Apple Team ID
142
+
1.`watcherMail`_: string_ - your mail address where you wish to receive reports. Mail has a strict form `[email protected]` which is passed as String.
143
+
1.`isProd`_: boolean | undefined_ - defaults to `true` when undefined. If you want to use the Dev version to disable checks described [in the chapter below](#dev-vs-release-version), set the parameter to `false`. Make sure that you have the Release version in the production (i.e. isProd set to true)!
144
+
145
+
If you are developing only for one of the platforms, you can skip the configuration part for the other one, i.e., delete the unused configuration.
211
146
147
+
#### Dev vs Release version
148
+
149
+
The Dev version is used to not complicate the development process of the application, e.g. if you would implement killing of the application on the debugger callback. It disables some checks which won't be triggered during the development process:
150
+
151
+
- Emulator-usage (simulator)
152
+
- Debugging (debug)
153
+
- Signing (appIntegrity)
154
+
- Unofficial store (unofficialStore)
155
+
156
+
### Callbacks
157
+
158
+
freeRASP executes periodical checks when the application is running. Handle the detected threats in the **listeners**. For example, you can log the event, show a window to the user or kill the application. [Visit our wiki](https://github.com/talsec/Free-RASP-Community/wiki/Threat-detection) to learn more details about the performed checks and their importance for app security.
159
+
160
+
### Initialization
161
+
162
+
You should initialize the freeRASP in the entry point to your app, which is usually in `App.jsx` or `App.tsx`. Just copy & paste this code inside your root component / function, then setup the configuration and reactions to listeners:
When freeRASP initializes correctly, you should see `freeRASP initialized` message in logs. Otherwise, you'll see warning with description of what went wrong.
264
217
265
-
_You can override this default behavior by extending the `actions` object with `'started'` key (to change action after successful initialization), and `'initializationError'` key (to set up action after unsuccessful initialization)_
218
+
_You can override this default behavior by extending the `actions` object with `started` key (to change action after successful initialization), and `initializationError` key (to set up action after unsuccessful initialization)_
219
+
220
+
## Step 5: Additional note about obfuscation
266
221
267
-
## Step 6: Additional note about obfuscation
268
222
The freeRASP contains public API, so the integration process is as simple as possible. Unfortunately, this public API also creates opportunities for the attacker to use publicly available information to interrupt freeRASP operations or modify your custom reaction implementation in threat callbacks. In order for freeRASP to be as effective as possible, it is highly recommended to apply obfuscation to the final package/application, making the public API more difficult to find and also partially randomized for each application so it cannot be automatically abused by generic hooking scripts.
269
223
270
224
### Android
225
+
271
226
The majority of Android projects support code shrinking and obfuscation without any additional need for setup. The owner of the project can define the set of rules that are usually automatically used when the application is built in the release mode. For more information, please visit the official documentation
You can make sure, that the obfuscation is enabled by checking the value of **minifyEnabled** property in your **module's build.gradle** file.
232
+
276
233
```gradle
277
234
android {
278
235
...
@@ -287,8 +244,7 @@ android {
287
244
}
288
245
```
289
246
290
-
291
-
## Step 7: User Data Policies
247
+
## Step 6: User Data Policies
292
248
293
249
Google Play [requires](https://support.google.com/googleplay/android-developer/answer/10787469?hl=en) all app publishers to declare how they collect and handle user data for the apps they publish on Google Play. They should inform users properly of the data collected by the apps and how the data is shared and processed. Therefore, Google will reject the apps which do not comply with the policy.
0 commit comments