4

I'm in the process of submitting an iOS application for a Salesforce security review. I'm having trouble figuring out what kinds of security scans/reports they're expecting for an iOS application.

According to the instructions in the Security Review wizard:

Offerings that include any non-Salesforce web applications, web services, client/mobile applications (even optionally) must run a Web Application Scanner (Burp) report.

It's possible to grab network traffic from an iOS app via Burp, but the automatic scanning and reporting doesn't really seem possible for a native app like this. What reports will the review team be expecting here?

Improve this question
1
  • If you haven't already, take a look at these other burp questions here.
    – Keith C
    Commented Dec 2, 2014 at 21:25

1 Answer 1

Reset to default
1

There is no scan for the iOS app, but if your iOS app communicates with an external (non-SFDC) webservice, then you should scan the webservice using the iOS app to drive Burp as a proxy.

You can do this by configuring your iOS device to connect to Burp as a proxy and then use the iOS app as intended to exercise all the interfaces of your webservice. Note that you are not scanning the iOS app, but the service it connects to.

If you app makes callouts only to Salesforce, then you don't need to submit a Burp scan.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .