Where are the OAuth tokens stored?

eduvpn / apple

app for iOS and macOS

Other

62 stars 18 forks source link

Closed ghost closed 4 years ago

ghost commented 4 years ago

Where are the OAuth access_token and refresh_token stored? Are those encrypted? How/where?

johankool commented 4 years ago

Those are stored in ~/Library/Containers/<bundle identifier>/Data/Library/Application Support/<bundle identifier>/<host>/portal/_oauth/authorize/authState.bin encrypted with a key that is stored in the keychain. See https://github.com/eduvpn/ios/blob/e1a3005439a7699f77f03ea4a0f76c19d4473d87/EduVPN-multiOS/Models/Managed%20Objects/Generated/Api%2BCoreDataProperties.swift#L76