Keep secrets out of device backups

How to do it

Both systems back up app data by default. Android Auto Backup is on for apps that target Android 6 and later. On Android 12 and later, list exclusions in dataExtractionRules for both cloud-backup and device-transfer. Keep a fullBackupContent file too for Android 11 and lower. Files in noBackupFilesDir and the cache folder are never backed up. On iOS, mark caches with isExcludedFromBackup, and give Keychain items a ThisDeviceOnly class. After a restore, the app asks the person to sign in again, as keep tokens and keys in the Keychain or Keystore expects.

Examples

XML example

<data-extraction-rules>
  <cloud-backup>
    <exclude domain="sharedpref" path="session.xml"/>
    <exclude domain="database" path="cache.db"/>
  </cloud-backup>
  <device-transfer>
    <exclude domain="sharedpref" path="session.xml"/>
  </device-transfer>
</data-extraction-rules>

Plain text example

var values = URLResourceValues()
values.isExcludedFromBackup = true
var cacheURL = cacheDirectory.appendingPathComponent("feed-cache.sqlite")
try cacheURL.setResourceValues(values)

Kotlin example

val deviceKeyFile = File(context.noBackupFilesDir, "device-key.bin")
deviceKeyFile.writeBytes(sealedDeviceKey)

How to check

Back up a signed-in test device and restore it to a second device. The app on the second device asks for a sign-in, and the person's own drafts are there.

Sources

• OWASP MASWE-0006, Sensitive Data Not Excluded From Backup
• Apple, isExcludedFromBackup
• Android, Back up user data with Auto Backup

Related rules

• Keep tokens and keys in the Keychain or Keystore in Mobile apps