App Groups let multiple components use shared storage. That convenience creates a shared trust boundary and a joint responsibility for cleanup.
Evaluation approach
Inventory every target with group access and the data stored there. Do not share session or key material that an extension does not need.
Application example
If a widget needs only a summary, share limited data rather than a full access token.
Limits and considerations
RASP in the main application may not automatically cover every extension flow.
Responsibility for shared storage
When several components access an App Group container, trusting its contents involves assumptions about every component with access. Do not assume that the main application's protection automatically extends to an extension.
Define data format, access conditions and update ordering. Test stale data and partial writes. At sign-out, establish which copies are deleted and how extensions learn the new account context.
Checks and decisions
- List group members
- Minimize shared data
- Test extensions separately
Identify the producer, consumer and deletion owner of each shared area.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.