Android Security: values.xml under res(generated) folder

user_13928327 0
Viewed 236

I am just curious to know about the file values.xml under the folder res(generated)/values. This file contains the firebase database URL, google API key etc information. Will it cause any security issue to the app? Can anybody access the firebase database using these values by decompiling the apk? Screenshot of the file is attached.

Screenshot of values.xml

firebase google-api android
1 Answers

You can create a file key.properties in your root directory with the values for different secret keys:

 GOOGLE_KEY="1234567890";  //Example

Then

def apikeyFile = rootProject.file("key.properties")
def apikey = new Properties()
apikey.load(new FileInputStream(apikeyFile))
 
android {

  defaultConfig {
     
    buildConfigField("String", "GOOGLE_KEY", apikey['GOOGLE_KEY'])
  }
}

You can now access these field anywhere within your source code with the BuildConfig object provided by Gradle:

String googleKey = BuildConfig.GOOGLE_KEY;
val googleKey    = BuildConfig.GOOGLE_KEY  //KOTLIN

FYI

Make sure to exclude the file from being checked in by adding to your .gitignore file:

key.properties
user_33951980
Related