Skip to main content Skip to main content

Mobile Security Overview (Current Mobile App)

  1. Youreka Knowledge Base
  2. Additional Resources
  3. Security Information

Youreka Mobile Security Overview

Note: There are two versions of this article. One for the old Youreka mobile app, available until mid-2024, and one for the current mobile app, available October 2022. This version is intended for users of the Current Youreka Mobile app. To access the article for the old Youreka mobile app, click here.

Youreka’s mobile application for iOS and Android leverages industry best practices for mobile authentication and local storage. It utilizes OAuth 2.0 PKCE (Proof Key for Code for Exchange) for user authentication and session management. It utilizes secure encrypted local storage via a SQLite database.

Authentication Process (OAuth 2.0 PKCE) 

First Time Authorization Flow

  1. User launches the Youreka app.
  2. User selects or enters a login domain.
  3. A Salesforce authentication prompt appears rendered using the system browser (following best practice).
  4. User enters a Salesforce username and password.
  5. Salesforce authenticates the user and responds with an authorization code. The app then requests an access token and refresh tokens using this authorization code. This is done to prove to Salesforce that the client requesting the token is the same client that successfully authenticated.
  6. User approves the Connected App's request to grant access.
  7. User is granted permission to user the app.

Online Authorization

  1. User opens a mobile app.
  2. If the access token is still valid, as confirmed by Salesforce, the app starts immediately. If the access token is no longer valid, the app uses the refresh token from its initial authorization to get an updated access token.
  3. The app resumes.

Offline Authorization

  1. User opens a mobile app while offline.
  2. The app checks for the presence of an access token from a previous session.
  3. If present, the app resumes.  If not, the user must login to use the app.

Local Data Storage

  • Youreka utilizes is stored in a SQLite database.
  • It is encrypted via SQLCipher using 256-bit AES encryption.
  • A PIN/Biometric locking system is on by default to protect against device theft/snooping.
  • The secret for the encrypted database is securely stored in the native keystore/keychain.
  • Upon logout all local data is destroyed.

More Information

Salesforce OAuth 2.0 Flow (including PKCE)

SQLite Database

SQLCipher Library

  • Updated
Was this article helpful?
0 out of 0 found this helpful
Return to top

Comments

0 comments

Please sign in to leave a comment.

©2024 Youreka   |   Privacy Policy