decodeObjectOfClassforKeydecodeObjectOfClassesforKey

decodeObjectOf... refers to a family of secure decoding APIs in Apple's Foundation framework, used when unarchiving objects with NSCoder/NSKeyedUnarchiver. These methods enforce that the decoded object is of an expected class or set of classes, helping prevent object substitution attacks during deserialization. They are part of the secure coding paradigm and are commonly used when supportsSecureCoding is implemented.

There are two main variants in Swift: decodeObject(of:forKey:) for a single allowed class, and decodeObject(ofClasses:forKey:) for a set of allowed classes. In Objective-C, the equivalents are decodeObjectOfClass:forKey: and decodeObjectOfClasses:forKey:. The result is typically cast to the expected type by the caller.

Usage examples in Swift include decoding a single class such as: coder.decodeObject(of: Account.self, forKey: "account") as? Account. For multiple allowed classes: coder.decodeObject(ofClasses: Set([NSString.self, NSData.self]), forKey: "payload") as? NSString. These calls are made in the context of a coder configured for secure coding, with requiresSecureCoding set to true and the decoded object’s class conforming to NSSecureCoding.

Security and design notes: Always specify a tight set of allowed classes to minimize risk, and ensure the classes involved conform to NSSecureCoding. These APIs are intended for unarchiving workflows where security cannot be compromised by loading arbitrary object types.

Availability and compatibility: The decodeObjectOf... APIs are available on iOS 11 and macOS 10.13 and later, and are part of secure coding practices recommended for modern app development.