LogoLogo
HomeArticlesCommunity ProductsPremium ProductsGitHubTalsec Website
  • 👋Introduction
  • đŸ› ī¸Integration
    • 🤖Android
      • API
      • Troubleshooting
    • 🍎iOS
      • API
      • Troubleshooting
    • đŸĻFlutter
      • FlutterFlow
      • API
      • Troubleshooting
    • âš›ī¸React Native
      • Expo
      • API
      • Troubleshooting
    • 👾Cordova
      • API
      • Troubleshooting
    • đŸĒŊCapacitor
      • API
      • Troubleshooting
  • 🚀Features and Pricing plans
    • The Key Differences: freeRASP vs. RASP+
  • 🎤What's New and Changelog
  • 📊Security Report
  • âš–ī¸User Data Policies
  • 📄License
  • 🤝Fair Usage Policy (FUP)
  • â„šī¸Wiki
    • Getting Signing Certificate Hash
    • Callback Delay, Telemetry Impact, and Threat Scanning Completion Status
    • Threat detection
      • Detecting rooted or jailbroken devices
      • Emulator detection
      • Hook detection
      • App tampering detection
      • Debugger detection
      • Detecting unofficial installation
      • Device binding detection
      • Missing obfuscation detection [Android devices only]
      • Secure Hardware detection (Keystore/Keychain secure storage check)
      • Passcode
      • System VPN detection
      • Developer Mode detection [Android devices only]
      • ADB enabled detection [Android devices only]
      • Screen Capture
    • Source code obfuscation
    • isProd flag
  • đŸĻ‰FAQ
  • 🧑‍đŸ’ģAbout Us
  • 🤝Contribution
Powered by GitBook
On this page
  • 📝 Prerequisites
  • Android
  • iOS
  • đŸ“Ļ Install the plugin
  • âš™ī¸ Setup the Configuration for your App
  • 👷 Handle detected threats
  • đŸ›Ąī¸ Start freeRASP
  • 🌁 Enable source code obfuscation
  • â˜ĸī¸ (Optionally) Integrate freeMalwareDetection

Was this helpful?

Export as PDF
  1. Integration

Cordova

Last updated 14 days ago

Was this helpful?

Example:

📝 Prerequisites

The freeRASP has the following prerequisites that must be met before starting.

Android

The Android implementation uses Kotlin serialization plugin; following line has to be added to the plugins block in platforms/android/build.gradle:

platforms/android/build.gradle
plugins {
    id 'org.jetbrains.kotlin.plugin.serialization' version '1.7.10'
}

freeRASP requires minSdkVersion level of >=23, targetSdkVersion level of >=31, compileSdkVersion level of >=34, and Kotlin support.

Since freeRASP 8.0.0, it is also necessary to raise version of Kotlin above 2.0.0 in your project.

Add the following lines to the config.xml file in your project root directory.

config.xml
<preference name="GradlePluginKotlinEnabled" value="true" />
<preference name="GradlePluginKotlinCodeStyle" value="official" />
<preference name="GradlePluginKotlinVersion" value="2.0.0" />
<preference name="android-minSdkVersion" value="23" />
<preference name="android-targetSdkVersion" value="31" />
<preference name="android-compileSdkVersion" value="34" />

Then run the following command to apply the preferences:

bash
$ cordova prepare android

Enable Screenshot and Screen Recording Detection

 <platform name="android">
  <config-file target="AndroidManifest.xml" parent="/*">
   <uses-permission android:name="android.permission.DETECT_SCREEN_CAPTURE" />
   <uses-permission android:name="android.permission.DETECT_SCREEN_RECORDING" />
  </config-file>
</platform>

Screenshot Detection is supported on Android 14 (API level 34) and higher. Screen Recording Detection is supported on Android 15 (API level 35) and higher.

To utilize active protection, you can use

await talsec.blockScreenCapture(true);

To receive whether the screen capture is blocked, you can use

const response = await talsec.isScreenCaptureBlocked();

For more details about all these screen capture methods, see Screen Capture.

iOS

freeRASP plugin uses Swift. Install the following plugin to support Swift in your project.

bash
$ cordova plugin add cordova-plugin-add-swift-support --save

đŸ“Ļ Install the plugin

Install the plugin using Cordova CLI

bash
cordova plugin add cordova-talsec-plugin-freerasp

âš™ī¸ Setup the Configuration for your App

In the the entry point to your app, import freeRASP and add the code below.

index.js
/* global cordova, talsec */

const config = {
    androidConfig: {
        packageName: 'com.example.helloapp',
        certificateHashes: ['mVr/qQLO8DKTwqlL+B1qigl9NoBnbiUs8b4c2Ewcz0k='],  // Replace with your release (!) signing certificate hash(es)
        supportedAlternativeStores: ['com.sec.android.app.samsungapps'],
    },
    iosConfig: {
        appBundleIds: 'com.example.helloapp',
        appTeamId: 'your_team_ID'
    },
    watcherMail: 'your_email_address@example.com',
    isProd: true
};

👷 Handle detected threats

Threat reactions can be specified inside a JavaScript object, which is then passed into the initialization function:

// reactions to detected threats
const actions = {
    // Android & iOS
    : () => {
        console.log('privilegedAccess');
    },
    // Android & iOS
    : () => {
        console.log('debug');
    },
    // Android & iOS
    : () => {
        console.log('simulator');
    },
    // Android & iOS
    : () => {
        console.log('appIntegrity');
    },
    // Android & iOS
    : () => {
        console.log('unofficialStore');
    },
    // Android & iOS
    : () => {
        console.log('hooks');
    },
    // Android & iOS
    : () => {
        console.log('deviceBinding');
    },
    // Android & iOS
    : () => {
        console.log('secureHardwareNotAvailable');
    },
    // Android & iOS
    : () => {
        console.log('systemVPN');
    },
    // Android & iOS
    : () => {
        console.log('passcode');
    },
    // iOS only
    : () => {
        console.log('deviceID');
    },
    // Android only
    : () => {
        console.log('obfuscationIssues');
    },
    // Android only
    : () => {
        console.log('devMode');
    },
    // Android only
    : () => {
        console.log('adbEnabled');
    },
    // Android & iOS
    : () => {
      console.log('screenshot');
    },
    // Android & iOS
    : () => {
      console.log('screenRecording');
    },
};

đŸ›Ąī¸ Start freeRASP

freeRASP can be started after the Cordova initialization is completed, for example, inside the onDeviceReady function in the index.js.

talsec.start(config, actions)
    .then(() => {
        console.log('Talsec initialized.');
    })
    .catch((error) => {
        console.log('Error during Talsec initialization: ', error);
    });

🌁 Enable source code obfuscation

The easiest way to obfuscate your app is via code minification, a technique that reduces the size of the compiled code by removing unnecessary characters, whitespace, and renaming variables and functions to shorter names. It can be configured for Android devices in android/app/build.gradle like so:

android {
    buildTypes {
        release {
            minifyEnabled true
            shrinkResources true
            proguardFiles getDefaultProguardFile("proguard-android.txt"), "proguard-rules.pro"
        }
    }
}

Additionally, create or extend proguard-rules.pro in android/app folder and exclude Cordova’s specific classes that rely on package names from being obfuscated:

proguard-rules.pro
-keep class org.apache.cordova.** {*;}
-keep public class * extends org.apache.cordova.CordovaPlugin
-flattenpackagehierarchy

Please note that some other modules in your app may rely on reflection, therefore it may be necessary to add corresponding keep rules into proguard-rules.pro file.

If there is a problem with the obfuscation, freeRASP will notify you about it via obfuscationIssues callback.


â˜ĸī¸ (Optionally) Integrate freeMalwareDetection

freeMalwareDetection is a powerful feature designed to enhance the security of your Android application by quickly and efficiently scanning for malicious or suspicious applications (e.g. Android malware) based on various blacklists and security policies.

It helps to detect apps with suspicious package names, hashes, or potentially dangerous permissions.

To and , add the following permission to your Android Manifest (via config.xml):

To ensure freeRASP functions correctly, you need to provide the necessary configuration and initialize it. All required values must be filled in for the plugin to operate properly. Use the following template to configure the plugin. Detailed descriptions of the configuration options are provided.

For Android apps, you must get your expected signing certificate hashes in Base64 form. You can go through to learn how to sign your app in more detail, including manual signing and using Google's Play app signing.

freeRASP executes periodical checks when the application is running. You can handle the detected threats using listeners. For example, you can log the event, show a window to the user or kill the application. See the in the wiki to learn more details about the performed checks and their importance for app security.

For the version you’re integrating, you can find the specific dSYMs for debugging in .

Read more about why this is important in the.

Visit the repository to learn more about this feature! For the integration, refer to the for the Cordova platform.

đŸ› ī¸
👾
https://github.com/talsec/Free-RASP-Cordova/tree/master/example
this manual
Threat detection
Releases
wiki
freeMalwareDetection
integration guide
on the API page
detect screenshots
screen recordings

isProd is a boolean flag that determines whether the freeRASP integration is in the Dev or Release version. If you want to learn more about isProd, visit this .

wiki section