search

kean / Pulse

Network logger for Apple platforms
https://pulselogger.com
MIT License
6.37k stars 311 forks source link

Is it permissible to submit the app to the App Store with Pulse included? #289

Closed wlxo0401 closed 2 months ago

wlxo0401 commented 2 months ago

Hello, I am planning to include a PulseUI menu button in the "More" menu, which can be toggled on or off through configuration settings. It will be hidden in release mode and visible in development mode.

However, even though the menu will be hidden, it seems that logging will still function internally. Could this pose a security risk?

I am also planning to use the "URLSessionProxyDelegate.enableAutomaticRegistration()" feature.

Thank you!

Translated using GPT.

kean commented 2 months ago

Hi, I would recommend turning the logging off in production.

The code in URLSessionProxyDelegate is fairly small, so I suggest reviewing it yourself. It is pretty straightforward and doesn't use private APIs if that's what you are asking. You shouldn't run into any issues with App Review. The log data is stored in the app container.

Pulse 5.0 is coming soon, so if you are just integrating the framework now, I recommend waiting a bit. There are a few significant improvements to the "request capturing" code, but URLSessionProxyDelegate.enableAutomaticRegistration will still be part of the public API.

wlxo0401 commented 2 months ago

@kean

Thank you for your quick response.

I think I didn’t provide enough details in my previous message.

The security issue I was referring to is the communication logs. From what I understand, logs are stored while the app is running, and I was concerned that someone might be able to access server information through them.

For now, I'll follow your advice and disable the logs before releasing to production.

I’ll try applying it once version 5.0 is released.

-- Translated using GPT.