requiresSecureCoding

requiresSecureCoding is a flag used in Apple’s data serialization APIs to enforce secure coding during unarchiving. It is a property associated with NSKeyedUnarchiver and related archiving APIs, and when enabled, it requires that all decoded objects conform to the NSSecureCoding protocol and are decoded using secure methods that specify allowed classes. This mechanism helps prevent security risks such as object substitution attacks when deserializing data from untrusted sources.

Background: NSSecureCoding is an extension of NSCoding that adds security guarantees for archiving and unarchiving. Classes that adopt NSSecureCoding must implement supportsSecureCoding and use secure decoding methods. When requiresSecureCoding is set, the unarchiver rejects attempts to decode objects that do not conform to NSSecureCoding and uses methods that enforce explicit class checks.

Usage: In Swift, you typically configure the unarchiver to require secure coding and then decode using class-restricted methods. For example, you can archive data with requiringSecureCoding and decode with decodeObject(of:forKey:) or decodeObject(ofClasses:forKey:) to specify allowed classes. Conversely, when archiving, using secure options helps ensure the resulting data is suitable for secure decoding later.

Limitations: Not all previously created archives can be decoded under secure coding; the decoded classes must conform to NSSecureCoding and be explicitly allowed by the decoding methods. If data originates from an untrusted or legacy source, enabling secure coding may require updating the encoded objects or their classes.

See also: NSSecureCoding, NSKeyedArchiver, NSKeyedUnarchiver, NSCoder.