Sensitive Data

If you want to save credentials — or any other sensitive data — on your mobile smart device in your Xamarin / Xamarin.Forms project you better take no risk and use the safest way possible.

Implementing secure storage in your Xamarin.forms app can be done as close to the native OS as possible.

Native Storage

But the safest way to actually save the sensitive data on your device is using the mobile platform’s NATIVE secure way of storing such information.
That means that you need to use the Keychain services in iOS, and the KeyStore class in Android to make sure the data is stored and encrypted accordingly.
These are just the best options as two big enterprises (Apple behind iOS, Google behind Android) have been working on things like security and have chosen to implement some kind of storage space that can be utilized by mobile apps to safely write down key-value pairs of information.

Key-Value Only

To be clear: they REALLY ARE intended for key-value pairs of information.
The native storage isn’t intended for big data chunks like binary data, video content or other stuff. For those, you’ll need to provide your own encrypted solutions and data-storage implementations.
Luckily, for us Xamarin developers, cross-platform abstracted plugins are available for integrating this in your shared code (whether it is a shared library or project).
Xamarin.Auth

“Xamarin.Auth” is the name of the first cross-platform save storage plugin and using it to save key-value data is a safe way to go.
The plugin is created by Xamarin and updated on a regular basis.

It helps you to save (key-value based) information via its abstracted cross-platform functions.
It will use the native storage of iOS and Android as indicated before and it has been used a lot by developers.

This isn’t a plugin purely for storage, though. And that might be a thing for some developers. As the name “.Auth” indicates, it is focussed on authorization and not purely on storage.

You’ll find the plugin here: Xamarin.Auth on GitHub

And A GitHub Recipe for Xamarin.Forms over here: Xamarin.Auth Recipe

Starter Issues When Implementing Xamarin.Auth

But when you’re creating a new iOS app version, there is one issue that often appears to be surfacing as soon as you want to actually save values to the secure storage.

The SaveAsync Error

“SaveAsync error = error = Could not save account to KeyChain: MissingEntitlement\nAdd Empty Entitlements.plist
File / New file / iOS / Entitlements.plist
SecKeyChain.Add returned : MissingEntitlement\n1. Add Keychain Access Groups to the Entitlements file.
Turn on the Keychain Sharing switch in the Capabilities section in the app.”
The error when building and trying to run the project on the iOS simulator

When you’ve followed the plugin steps, there are two problems preventing you from running this smoothly for now. What follows below are the two fixes needed to get Xamarin.Auth working for your solution.

Step One: Enable Keychain Usage

You need to enable the app to use the keychain as follows:

In Visual Studio for Mac, double click Entitlements.plist in your file inspector
scroll down to the Keychain item and select “Enable Keychain”
this will add the “Keychain Access Groups” value to the plist.

This was an easy one to fix, right?

Step Two: Entitlements Not Found On The Simulator

The Entitlements.plist is present when you create a Xamarin.Forms application, and can be found in the .iOS project’s root.

The problem, however, is that by default, this entitlement file isn’t included into the simulator build target.

And we need the simulator to run and check how our app operates at the simplest level, at least. It would ruin the workflow for thousands of Xamarin developers if there wouldn’t be a way around it, right?

The steps to fix this are as follows:

In Visual Studio for Mac, double click the .iOS project
Select iOS Bundle Signing
Verify that you’ve selected the Debug Configuration for the iPhoneSimulator platform
Set the value Entitlements.plist as value for the Custom Entitlements input field

Now, your entitlements file will be packed together with the debug build for iPhone Simulator targets and work as expected.
There is a comment for a related issue in the GitHub repo indicating you should add an environment variable named “ENTITLEMENTS_REQUIRED” with the value “yes” in order for the project to generate the entitlement file without packing the one already in your project.
This might be because the original entitlements file might be packed with more sensitive stuff which you don’t want to be saved on your harddisk and in simulator versions all over the place. I’m still checking into this option though.

Xamarin Essentials: Secure Storage

Xamarin Essentials is a packaged set of tools, that evolved out of the cross-platform needs of Xamarin developers. If you will, it’s a bouquet of plugins that have been optimized to use the same API interfacing, enjoy great documentation and seems to be the better implementation.

You can check out the formal Microsoft documentation here:
Xamarin Essentials: Secure Storage documentation

As it appears, it uses the same principles for safe storage as the Xamarin.Auth plugin.

As indicated, Xamarin Essentials is a package bundle that bears a lot of functionality. One of those pieces is Secure Storage.

One Plugin BUT Linker Safe

Although the Essentials package comes as ONE NuGet package, it is implemented Linker Safe. What that means for the size of your application?

The repo’s FAQ page explains it the best:

We built Essentials to be Linker Safe, which means if you only use ONE feature that is the ONLY feature that will be added to your app. The rest will be linked away and even works with Link All Assemblies.

Encryption Included

One advantage that was immediately visible in the documentation and code for this secure storage implementation is that it is also stored encrypted and utilizes a secure way to ensure you need to unlock the device and/or enter the application to get to the stored value.

There you have it. Two ways to make sure that passwords, tokens or other small pieces of sensitive data can be securely stored on the device.

Keep in mind that, in the end, nothing digital is un-hackable. But saving data using the native mobile platform’s best practices is the minimum effort that a mobile developer should implement.

Helpful Link1 Link2 Link3 Link4 Link5