Skip to content

Salesforce Mobile SDK 14.0.0

Latest
Latest

Choose a tag to compare

View all tags
@wmathurin wmathurin released this 05 Oct 23:24
· 59 commits to dev since this release
v14.0.0
91d437b

What's New in Mobile SDK 14.0.0

Mobile SDK 14.0.0 is a major release that strengthens authentication security, raises the minimum supported iOS version, and updates SQLCipher. It also removes the SDK instrumentation subsystem and continues the migration away from deprecated APIs.

In major releases, we remove items that were deprecated in earlier releases. Check compiler warnings after upgrading so that you can address deprecations before they become removals in a future release.

Grab the Latest Here

Secure Authentication Defaults

Mobile SDK 14.0.0 enables DPoP and Advanced Authentication by default for new logins.

DPoP Is Enabled by Default

Demonstrating Proof of Possession (DPoP) binds OAuth tokens to the device that obtained them. Mobile SDK creates and manages the per-user key material, using the Secure Enclave when available, and adds DPoP proofs to supported authentication and API requests.

usesDPoP now defaults to true, so new logins request DPoP-bound tokens without an app change. Existing users retain the token type of their current credentials until they authenticate again or the app explicitly migrates them.

Apps can temporarily opt out for new logins by setting usesDPoP to false before starting authentication:

SalesforceSDKManager.shared.usesDPoP = false

This setting affects new logins only. A credential that is already DPoP-bound continues to send DPoP proofs even if the global setting is later changed to false.

Release 264 (Winter '27) makes DPoP generally available and adds a per-app control that lets admins require it for a Connected App or External Client App. Enforcement is expected in 2027, initially for new External Client Apps, and may later expand to all apps. The control's availability does not itself enforce DPoP for all apps; the enforcement schedule and final scope are not yet confirmed.

The SDK opt-out controls client behavior only; it does not override a server-side DPoP requirement. If DPoP is required for an app, a client configured to use Bearer tokens will be unable to authenticate.

Migrate Already Logged-In Users to DPoP

Existing users who authenticated before the upgrade retain their Bearer sessions. To migrate an already logged-in user without changing the connected app, call upgradeToDPoP(_:success:failure:). The API reauthenticates with the user's existing client ID, redirect URI, and scopes, and replaces the credentials with DPoP-bound credentials. It works independently of the usesDPoP setting. Salesforce can still present an approval screen during reauthentication.

UserAccountManager.shared.upgradeToDPoP(userAccount, success: { upgradedAccount in
    // The account now has DPoP-bound credentials.
}, failure: { error in
    // Handle the migration failure.
})

DPoP in Hybrid Remote Apps

Hybrid remote apps can now rely on mainSid to get the correct session token for WebView cookie injection regardless of auth type. The server returns ui_sid in DPoP token responses; mainSid is a computed property on SFOAuthCredentials that resolves ui_sid for DPoP sessions, parentSid for JWT Bearer, or accessToken for opaque Bearer.

Route specific requests to ui_sid Bearer. When a session is DPoP-bound and a UI-session token is available, apps can supply a path policy so that specific request paths use ui_sid Bearer authentication while everything else continues to use DPoP. By default no paths are opted in, so DPoP is used for all requests.

Advanced Authentication Is Enabled by Default

Advanced Authentication uses a browser-based OAuth session. In Mobile SDK 14.0.0, it is enabled by default for all login servers except Welcome, including login.salesforce.com and test.salesforce.com. Apps that previously used an embedded web view for these login servers now use a browser session.

Apps can temporarily opt out by setting forceAdvancedAuthentication to false before starting authentication:

SalesforceSDKManager.shared.forceAdvancedAuthentication = false

forceAdvancedAuthentication is deprecated in 14.0.0 and is planned for removal in Mobile SDK 15.0.0. Test browser-based login, logout, and account-switching flows as part of your upgrade.

The OAuth User Agent Flow Is Being Retired

Mobile SDK uses the OAuth web server flow by default. The user agent flow, selected by setting useWebServerAuthentication to false, is being retired and is expected to no longer be supported by the server.

SalesforceSDKManager.shared.useWebServerAuthentication = false

useWebServerAuthentication is deprecated in 14.0.0 and is planned for removal in Mobile SDK 15.0.0, or sooner if the server no longer supports the user agent flow. Remove any code that sets this flag to false so that your app always uses the web server flow.

Refresh Token Rotation Hardening

Mobile SDK now serializes token refresh requests per user. This change prevents concurrent refresh requests from racing when the server rotates a refresh token, which could otherwise cause unexpected logouts. No app changes are required.

App Attestation Preview

Mobile SDK includes client support for Salesforce App Attestation, which uses Apple App Attest to verify app and device integrity during login. Server-side enforcement is not yet generally available. Confirm Salesforce availability and configure Apple App Attest before enabling this feature in production.

To enable client-side attestation, set UserAccountManager.shared.appAttestationEnabled to true before authentication.

OAuth and Authentication APIs

  • OAuth errors are available as typed SFOAuthErrorCode values. Migrate code that compares raw OAuth error strings to use the typed error code where possible. Legacy string constants are deprecated.
  • SFOAuthSessionRefresher is deprecated. Use UserAccountManager.refresh(credentials:) instead.
  • UserAccountManager.upgradeToDPoP(_:success:failure:) upgrades an existing Bearer session to DPoP-bound credentials in place. Use this API to migrate already logged-in users before DPoP is required for their app.

Feature-Flag Telemetry

SDK feature flags are now persisted per user and included in the SDK User-Agent string. The SDK automatically records flags for login method and server type, session security such as DPoP and refresh token rotation, and other authentication characteristics. No app changes are required.

If your app registers custom SDK feature flags, migrate to the per-user APIs: SFSDKAppFeatureMarkers.registerAppFeature(_:forUser:) and SalesforceSDKManager.userAgentString(_:forUser:).

Actionable Notifications

The encrypted-notification template includes actionable-notification scaffolding. It retrieves notification types, registers iOS notification categories, and handles notification actions that invoke server-side actions.

Biometric Authentication

BiometricAuthenticationManager.automaticPresentation can automatically present the biometric opt-in dialog after login and the biometric prompt when an opted-in user's app locks. This simplifies biometric authentication integration, including in SwiftUI-based apps.

Removed APIs and Components

The SDK instrumentation and signpost subsystem has been removed. Remove app references to these SDK types and APIs:

  • SFInstrumentation, SFMethodInterceptor, and SFSDKInstrumentationHelper
  • SFRestAPI+Instrumentation, SFUserAccountManager+Instrumentation, and SFMobileSyncSyncManager+Instrumentation
  • sf_os_signpost_interval_begin, sf_os_signpost_interval_end, and sf_os_signpost_id macros
  • SFTestContext, SFSDKAsyncProcessListener, and SFSDKOAuthSessionManaging
  • SFOAuthCoordinator.userAgentForAuth
  • signposts_post_install from Podfile post_install blocks

Also replace SFSDKWebViewStateManager.removeSession() with resetSessionCookie(). The shared process-pool API has been removed.

Native App Templates

The Objective-C native app-generation template has been removed. The forceios command now generates native apps with the Swift native_swift app type. Existing Objective-C apps continue to work with the SDK libraries.

Xcode 27 Compatibility

  • Native iOS templates — Pod deployment target floor raised to 15.0.
  • Hybrid SDK — CocoaPods submodule references replaced with Swift Package Manager; CocoaLumberjack updated to 3.9.1.
  • Hybrid templates — A post_install hook is automatically injected into Cordova-generated Podfiles to raise pod targets below 15.0.
  • React Native templates — The RN iOS templates adopt the UIKit scene lifecycle and are compatible with Xcode 27.

Version Updates

  • Minimum deployment target: iOS 18.0
  • Base SDK: iOS 18
  • SQLCipher: 4.17.0
  • CocoaLumberjack: 3.9.1 (up from 3.8.5)

All Mobile SDK podspecs require iOS 18.0. Update your Podfile and Xcode project deployment target before installing Mobile SDK 14.0.0. If your app explicitly pins SQLCipher, update the pin to a compatible 4.17.0 version.

External Component Version Updates

  • React Native: 0.86.0
  • Cordova iOS: 8.1.0

React Native New Architecture

React Native 0.86.0 requires the New Architecture. Mobile SDK React Native apps use bridgeless mode and TurboModule-based native bridges; the legacy architecture is no longer supported. Replace @react-navigation/stack with @react-navigation/native-stack. iOS apps must set RCTNewArchEnabled and UIViewControllerBasedStatusBarAppearance to YES in Info.plist.

Bug Fixes

  • REST completion races and deadlocks — Races in SFRestAPI between token-refresh replay and task terminal completion could cause a REST completion block to fire twice; for the Swift async API this crashed the process by resuming a checked continuation twice. Replay and terminal delivery are now serialized so exactly one terminal callback runs per request, and a request that logout cleanup has already retired no longer publishes a network task. Network and User-Agent work no longer runs while holding the REST lock, avoiding a lock inversion and a class-monitor deadlock that could freeze the app during multi-user logout/login. Related concurrency hardening makes internal safe-collection writes publish synchronously, fixing a starvation case where in-flight requests under heavy concurrent load could hang with no completing continuation.

Deprecated APIs

The following APIs are deprecated in 14.0 and will be removed in 15.0. Compiler warnings only — they still work.

  • IDP login flow — No drop-in replacement; apps should migrate to advanced (browser-based) auth.
  • useWebServerAuthentication — The OAuth user agent flow is being retired; the web server flow will be used going forward.
  • forceAdvancedAuthentication — Planned for removal in 15.0.
  • SFOAuthSessionRefresher — Use UserAccountManager.refresh(credentials:) instead.
  • OAuth error string constants — Use typed SFOAuthErrorCode values instead.

For the complete list, check compiler warnings or see the iOS current deprecations reference.

Agent Skills for App Developers

Mobile SDK now publishes installable agent skills that guide AI coding agents through building iOS Swift apps with the SDK — creating a new app and adding authentication, SmartStore, MobileSync, and biometric authentication (Face ID / Touch ID) — along with guided upgrade skills for moving an app from 12.x to 13.x and from 13.x to 14.0. Add them to your project with:

npx skills add forcedotcom/SalesforceMobileSDK-Templates

See the consumer skills README for the full catalog.

How to Upgrade Your Apps

To upgrade to Mobile SDK 14.0.0:

  1. Set the deployment target to iOS 18.0.
  2. Update Mobile SDK dependencies to version 14.0.0.
  3. Update explicit SQLCipher pins to version 4.17.0, if applicable.
  4. Remove references to the instrumentation subsystem and other removed APIs.
  5. Test browser-based Advanced Authentication and DPoP-enabled login flows. For apps where DPoP is not required server-side, the temporary opt-out can provide additional migration time; it does not bypass per-app enforcement.
Assets 2
Loading