Question about posting project files (.aia) containing "secure" information

General Discussion
1

Hi!

If you are building (compiling) an app for iOS you need to have an Apple Provisioning Profile file (.mobileprovision) in the Media (assets) drawer.

If you are using the Spreadsheet component you need to have a Google Sheets JSON Credentials file available to the app. (Probably uploaded to the Media drawer.)

My question is: If I post an App Inventor project (.aia) for review or use by others, should I strip the Provisioning and JSON Credentials files from the project before posting?

Am I giving away any security information if I leave them in the project when I post it?

Thanks!

--- tom

2

What (and Where) do you consider it to be "secure" information?

Personally I would use web component and google apps script, or one of the many free google sheet/drive extensions. (if not using ios)

3

You should remove the JSON credentials for iOS, and any ApiKey fields you've populated in components such as ChatBot, before sharing the AIA file. A provisioning profile actually doesn't contain any sensitive information. It is a cryptographically signed binary plist file created by Apple that encodes the public key portion of your signing certificate and other app metadata. However, it also won't hurt to remove it (nobody can use your provisioning profile without the private key in the keystore, which is in your user account not the project).

4

How will that work if the developer want users to access their (the developers) curated google sheet...?

One could call in the credentials.json/spreadsheetID from an online resource when the app starts or user clicks button, so it is only available at runtime. Protect the call with a password provided for trusted users, outside of the app.

5

@TIMAI2 -

I've discovered that the Spreadsheet.ErrorOccurred() event doesn't return
the "same" error message in iOS that its does in Android. (The message in
iOS appears to be "cooked" and not nearly as easy to handle as the message in
Android.)

I've been putting together a sample app to post along with screenshots. Thus, my
question about what "secure" files are safe to post.

I've tried accessing the spreadsheet via the Web component but that has
proven to be difficult because there doesn't appear to be a way to supply the JSON
Credentials file. Please let me know if I've overlooked a sample for accessing
a Google Sheet using the Web Component on iOS.

Cheers!

--- tom

6

Maybe Google's scripting language?

7

Some guides for you:

If you really want a deep dive into Google Apps Script & Web Apps, here is the canonical from Tanaike: