fix(secure-storage): make the ios simulator NSUserDefaults fallback opt-in

[edusperoni]

Spoofable simulator detection downgrades secure storage to plaintext

SecureStorage on iOS decides whether to use the keychain or fall back to NSUserDefaults in its constructor. The pre-iOS-9 branch of that decision was:

this.isSimulator = UIDevice.currentDevice.name.toLowerCase().indexOf('simulator') > -1;

UIDevice.name is the user-editable device name (Settings → General → About → Name). A real device named e.g. "my simulator" therefore takes the fallback path, and every get/set/remove (sync and async) silently reads and writes plaintext NSUserDefaults instead of the keychain — with no error, no log, and no API difference. That is user-controlled input deciding whether secrets are encrypted.

The iOS 9 gate guarding that branch is dead code — the plugin's deployment target is far above iOS 9 — so the branch is removed entirely. Simulator detection is now solely the SIMULATOR_DEVICE_NAME environment variable, which is set by the simulator runtime and is not settable on a device.

The fallback shares a namespace with plain application settings

When active, the fallback writes the raw, unprefixed key straight into NSUserDefaults.standardUserDefaults — the same domain and key namespace that ApplicationSettings and any other plain NSUserDefaults usage writes to. "Secure" and plain values collide on one store, so an app migrating a plaintext value into secure storage under the same key can destroy the value it is migrating, on the simulator only, in a way that never reproduces on device.

Why flipping the default is safe

The fallback exists for the Xcode 8 / iOS 10 simulator era (2016), when SecItemAdd returned -34018 (errSecMissingEntitlement) in simulator builds that had no embedded application-identifier entitlement (see EddyVerbruggen/nativescript-secure-storage#10). Since Xcode ~9 (2017) Xcode embeds entitlements into every simulator build via the __TEXT,__entitlements section, so the simulator keychain works the same as on device. The workaround has outlived its cause, and defaulting to it means the least secure path is the one nobody opts into.

disableFallbackToUserDefaults now defaults to true. The fallback remains available, unchanged, for anyone on a toolchain old enough to need it.

Changes

• packages/secure-storage/index.ios.ts: disableFallbackToUserDefaults defaults to true; the iOS 9 version gate and the UIDevice.currentDevice.name detection branch are deleted, leaving the SIMULATOR_DEVICE_NAME check.
• packages/secure-storage/README.md: documents the new default, how to opt back in, and why the fallback is not equivalent to the keychain.

Android is untouched — the fallback is iOS-only.

Breaking change

Values written on the iOS simulator through the old NSUserDefaults fallback are not visible to the keychain path and will read back as null. This affects simulator development data only; nothing on device changes, since device builds already used the keychain (unless the device name happened to contain "simulator", which is precisely the bug).

To restore the previous behaviour:

const secureStorage = new SecureStorage(kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, false);

Validation

npx tsc -p packages/secure-storage/tsconfig.json --noEmit passes; the touched TS file is prettier-clean. (The README was already not prettier-clean on main, so it was left unformatted rather than reformatted wholesale.)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d78ae389-636e-4a4e-80a9-879d0b5e3022

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}