Security jQuery Mobile + Phonegap

Question

I'm new in development Html 5 for smartphones and tablets and am currently on a project Html 5, CSS, jQuery Mobile and PhoneGap.

The application performs communication with the server via SOAP Web Service performed via XMLHttpRequest. And how am newbie wanted to know what the concerns that I have to take issue of security in the application if I have to resort to plugins, data encryption etc., all I need to use for security.

Validation username and password'm not using form. Do not pass parameters between pages. I'm not using php. I do not know if it works to circumvent the visibility of the code because I am developing for Android and iOS.

For my inexperience provisionally'm using global variables in. Js to save the username and password for access to other methods of web sevice. Please request help on this security issue because I do not know where to start, continue and finish.

Thanks!

Answer 1

There is a very detailed breakdown of PhoneGap & security available at: https://github.com/phonegap/phonegap/wiki/Platform-Security

In a nutshell, if you are concerned about "over the air" transmission of data, use a server with SSL, the same way you would in a web application. If you are concerned about device encryption, it is delegated to the default security mechanisms of the operating system.

Answer 2

Your particular stack of technology is no different than any other web application. You are still going to be vulnerable to a large number of vulnerabilities.

From the sounds of it, you're only concerned about the client side vulnerabilities that you should take into account. If this is the case, there are a number of things you should take into account.

1. If you're using HTML5, ensure it any local API's that you are using are protected. OWASP has a good list of best practices to follow https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet only some of these may be applicable to your specific application.
2. Any type of defense that you are going to implement for XSRF, or CSS (Cross-Site Scripting or XSS) will be in vain. The only type of defenses that will work across the board are ones that are implemented on the server side of the application (PHP, in this example).
3. Also, if you want the data to be encrypted in transit by SSL, this must be handled by the server (the SOAP web service endpoint). If this can't be accomplished, then a more complicated alternative would be to use WS-Security (http://en.wikipedia.org/wiki/WS-Security)