Security concerns

Now that we've covered file transfers, it's important to go over some important security concerns, since your app is no longer a silo disconnected from the rest of the Internet.

• Your app shouldn't automatically trust the content that it receives from the server. The server could be compromised, or a man-in-the-middle attack might potentially modify the content.

• Your server definitely shouldn't automatically trust the content it receives from your app (or anywhere else). Your best bet is to scan every uploaded file using a virus scanner; but this is, of course, not an absolute guarantee.

• If at all possible, you should favor SSL connections (HTTPS) rather than unencrypted communication.

• While using SSL connections, self-signed certificates and certificates that are signed by a certificate authority that the device doesn't trust will be rejected. Rather than setting trustAllHosts to true, endeavor to provide trusted certificates on the servers you control.

• If you're sending authentication...