In a previous post we discussed the benefits of using Apple’s DeviceCheck API to verify that an HTTP request originated from a legitimate iOS device. Now we’ll go a step further and look at the App Attest service, which can establish trust with an instance of an iOS App using keys issued by Apple.
Mobile APIs are a common target for attempting to exploit a web server, and there are typically many layers of security built into a web infrastructure. We will discuss how an application server can determine that requests are coming from a legitimate source, in this case a trusted mobile app running on a mobile device.
When developing using an SFDX Package Development Model there may be situations where valid code generates an error. We’ll take one small Apex/SOQL example today and use a simple workaround to get this code into the package.