search

forcedotcom / SalesforceMobileSDK-Android

Android SDK for Salesforce
Other
341 stars 388 forks source link

ClientID/Consumer Key Displayed on the Device when Device is offline. #2521

Closed nzsrini closed 8 months ago

nzsrini commented 8 months ago

Please fill out the following details:

  1. Version of Mobile SDK Used: 11.1.0
  2. Issue found in Native App or Hybrid App: Native
  3. OS Version: Android
  4. Device:
  5. Steps to reproduce: Go Offline on Device , And try to login and you will be able to see the Error page. Displaying the clientId which is consumer key. using a simulator or real device with inspection tools (such as appium inspector) on the machine we are able to extract the URL .

clientID is visible

CLientIDIssues

  1. Expected Behavior: it should not display the URL with clientId details.

  2. Error Log:

brandonpage commented 8 months ago

ClientId/Consumer Key and oauth redirect are not considered secret. Since they ship with the app they could also be pulled from a decompiled APK without much effort.

Additionally I don't believe we have any control over this error message as it comes from the system webview.

nzsrini commented 8 months ago

Thanks for the feed back.