Secure Credential Storage

Relevant source files

The following files were used as context for generating this wiki page:

• KeychainManager.swift
• APIClient.swift
• UserService.swift
• DeepLinkHandler.swift
• AppDelegate.swift

The Social-Connect application implements a secure credential storage system to protect sensitive user information, specifically authentication tokens. This system centralizes sensitive data management through a dedicated manager that interfaces with the iOS Keychain services, ensuring that credentials remain encrypted and isolated from the rest of the application's local storage.

Secure credential storage is integrated into the networking layer to automate authentication for outgoing requests. This ensures that features like user following, profile navigation via deep links, and general API interactions are performed securely without exposing raw tokens within the application's business logic.

Keychain Management Architecture

The core of the security system is the KeychainManager class, which provides a singleton interface for interacting with the system keychain. It abstracts the complexity of Security framework queries into high-level methods for token retrieval.

Key Components

• KeychainManager: A singleton class responsible for querying the iOS Keychain.
• APIClient: Uses the KeychainManager to inject authentication headers into HTTP requests.
• UserService: Coordinates high-level user actions that rely on authenticated API calls.

The diagram above illustrates the relationship between the security management layer and the service layers.
Sources: KeychainManager.swift:4-7, APIClient.swift:3-7, UserService.swift:3-6

Token Retrieval Logic

The system retrieves the authToken using specific attributes defined by the Security framework. The query targets generic password items associated with a specific account key.

Attribute	Value	Description
kSecClass	kSecClassGenericPassword	Specifies the item class as a password.
kSecAttrAccount	"authToken"	The unique identifier for the credential.
kSecReturnData	true	Requests the actual data payload.
kSecMatchLimit	kSecMatchLimitOne	Ensures only the most recent/relevant item is returned.

Sources: KeychainManager.swift:10-15

func getAuthToken() -> String? {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: "authToken",
        kSecReturnData as String: true,
        kSecMatchLimit as String: kSecMatchLimitOne
    ]
    
    var dataTypeRef: AnyObject?
    let status = SecItemCopyMatching(query as CFDictionary, &dataTypeRef)
    // ... validation and return logic
}

Sources: KeychainManager.swift:9-24

Authentication Flow in Networking

When a network request is initiated, the APIClient checks for the existence of a stored token. If found, it appends a "Bearer" token to the "Authorization" HTTP header.

This flow demonstrates how credentials are automatically attached to requests without manual intervention from the caller.
Sources: APIClient.swift:18-21, UserService.swift:9-13

Application Integration and Entry Points

Credentials are used to authorize actions triggered by various application events, such as deep links or app lifecycle transitions.

Deep Link Authorization

The DeepLinkHandler processes incoming URLs (e.g., profile, follow) and delegates actions to the UserService. Since these actions (like following a user) require authentication, the system relies on the KeychainManager being populated.

Implementation Summary

• AppDelegate: Receives the deep link URL and passes it to the handler.
• DeepLinkHandler: Parses the userId and calls the UserService.
• UserService: Initiates the APIClient call which fetches the token.

Feature	Trigger	File Reference
User Following	follow://?userId=123	DeepLinkHandler.swift:42-49
API Authorization	Network Request	APIClient.swift:18-21
Keychain Access	Data Fetch	KeychainManager.swift:9-22

Sources: AppDelegate.swift:18-21, DeepLinkHandler.swift:9-12, UserService.swift:11-15

Conclusion

The secure credential storage in Social-Connect leverages the iOS Keychain to provide a robust security layer. By abstracting keychain operations within the KeychainManager and automating token injection in the APIClient, the application ensures that all sensitive user actions—whether triggered via the UI or deep links—are performed under a secure, authenticated context.