Security-scoped bookmarks to iCloud files across devices

Question

Created Jan ’20

Replies 5

Boosts 0

Views 1.1k

Participants 2

Using CloudKit, it is possible to store a security-scoped bookmark to some file stored in iCloud, in the local file system, or even in Dropbox. Later, the bookmark can be retrieved from the CloudKit database and the corresponding file open.

However, retrieving the bookmark from another device connected to the same iCloud account does not work, though it seems that it should. For instance, the app lets users create a catalog of specific iCloud files selected through the document picker. The user should then be able to run the app on another device connected to the same iCloud account, in order to browse that catalog (stored in CloudKit) and retrieve the files to which the user has legitimate access.

This does not work. It seems that the security-scoped bookmark is tied to the device on which it was created, even though such bookmarks are supposed to be portable as long as they refer to the exact same file, not a copy thereof. In this case, the file is in iCloud so it is exactly the same regardless of the device used to access it.

Is there a way to achieve multidevice support for security-scoped bookmarks as long as the user has legitimate access to the corresponding files, either as their owner or as a user who was granted read or write access via CloudKit?

Thanks for any help.

Boost

Answer 1

john daniel OP

Jan ’20

The only mention of portability in the documentation involves document-scoped bookmarks. If you have a document package containing text and image attachments, then the those image attachent still need to work if you send the document to someone else.

But if any type of security-scoped bookmark were portable, it would be a security risk. Malicious apps could just include bookmarks to private user data and that would give the app instant access.

0

Answer 2

jmdecombe OP

Jan ’20

Good point on portability and I suppose that I did not exactly mean to say that. What I was really trying to say is that, if you create a legit security scoped bookmark and store it using CloudKit from your own iCloud account, then it should work regardless of the device from which you later access it, as long as you are also securely signed into your account on that device. If I use the document picker to bookmark a file from my iPhone, I should then be able to access that bookmark from my iPad connected to the same iCloud account.

0

Answer 3

john daniel OP

Jan ’20

I'm not sure what you mean by "security scoped bookmark" in this context. A security scoped bookmark is an internal object. They aren't directly accessible by users at the Finder level. Aliases exist but only for macOS. They are a Finder construct and they may be machine-specific. They are definitely not documented. A bare URL would be portable, but not particular useful as it is just a string,

0

Answer 4

jmdecombe OP

Jan ’20

Again, I guess that I was not clear. Let me give me an example. The app lets users create notes, but also attach files to them, not by copying those files but by keeping references to them, thus the reliance on security scoped bookmarks, so that users can restart the app and still access the attached files. This works well, until users launch the app on a different device than the one used to attach the files, but where the files are still accessible, e.g. stored in iCloud or Dropbox (all devices are connected to the same iCloud and Dropbox accounts). In that case, the bookmarks are not resolved. Will try to change to document scope instead of app scope, but it seems it should work either way. Cheers.

0

Answer 5

john daniel OP

Jan ’20

Suppose I create a note. I attach to that note the database file for my Safari browse history. I configure the app to upload my Safari browse history to the internet. I'm not crazy, so I make sure to clear my history before saving the document.

But I am malicious, so after saving the document, I send it to someone I want to stalk with some other, apparently innocuous behaviour. Now I have their browsing history.

This will not work, by design. A document-scope would work, but you will have to use a file wrapper and store the attached file inside the document itself.

0