I created a small Cordova iOS hybrid project which has login functionality in JSP page. We took memory dump for the app in a Jailbroken device and found the password is visible in it. Is there any way to remove sensitive information from UIWebView heap memory?
Password found in heap dump - iOS
Is there any way to remove sensitive information from
heap memory?UIWebView
No. If the password is used in cooperation with Apple’s high-level frameworks (for example, you get it from a secure text field, or you use it with
NSURLSessionps If you’re concerned about security, you definitely need to move over to
WKWebViewShare and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"