# Package com.codename1.security.shield

package com.codename1.security.shield

API shielding: attestation tokens, over-the-air certificate pinning, and runtime self-protection reporting.

Start at `AppShield`.

##### What this can and cannot do

Worth being precise about, because the category attracts overclaiming. On a device the attacker fully controls, no client-side check is unbypassable -- detection code can be patched out and headers can be stripped. What this buys you is threefold:

1. Your backend gets a cryptographically verifiable statement from Apple or Google about the app and device, evaluated by a service the attacker does not control. That is a categorically different thing from a boolean your own app computed about itself.
2. The cost of scripted abuse rises from "reproduce the API calls with a shell script" to "reverse-engineer and re-sign a native binary, per release".
3. Certificate pins rotate over the air, so a pin change no longer needs an app store release -- which is what makes pinning practical to run at all.

It does not make an app unhackable, and any product in this space that says otherwise is selling something.

##### The load-bearing part is on your server

The token means nothing until your backend refuses to serve requests without a valid one. Until that check exists, adding the shield changes nothing about your security.

- Related Packages
  Package
  Description
  com.codename1.security
  Cryptographic primitives and conveniences: hashing, message authentication, symmetric/asymmetric encryption, digital signatures, JWTs, OTPs and random number generation.
  com.codename1.security.shield.spi
  Service-provider interface between the public shield API and the attestation engine.
  com.codename1.security.hardening
  Read-only reporting of Codename One App Hardening status for the current build.
- Class
  Description
  AppShield
  API shielding: proves to your own backend that a request came from a genuine, unmodified build of your app running on a device that has not been tampered with.
  FailureMode
  What a protected host should do when a token cannot be obtained.
  HostPolicy
  What the shield does for a given host: whether to attach an attestation token, whether to enforce certificate pins, and what to do when a token cannot be obtained.
  PinSet
  An immutable set of certificate pins, keyed by host, as published by the attestation service.
  ShieldConfig
  Configuration for `AppShield.init(ShieldConfig)`.
  ShieldException
  Raised when a shield operation cannot produce a usable token, or when a request to a protected host is refused because its certificate chain matched no configured pin.
  ShieldListener
  Callback for shield state changes.
  ShieldSignal
  One runtime self-protection observation, such as "a hooking framework is loaded".
  ShieldSignals
  Collection point for runtime self-protection observations.
  ShieldStatus
  Outcome of a shield operation.
  ShieldToken
  A short-lived attestation token, ready to be attached to a request.