#webmate #secure-screen #how-to

Secure-screen bypass

Android provides a security mechanism called FLAG_SECURE that helps protect sensitive information displayed within an application. Applications commonly enable this flag on screens containing passwords, banking information, personal data, or other confidential content.

When FLAG_SECURE is enabled, Android enforces the following restrictions:

  • Screenshot Protection: Screens protected by FLAG_SECURE cannot be captured through screenshots or screen recordings.

  • Display Protection: Protected content cannot be displayed on non-secure external displays, such as TVs, projectors, or other screen-mirroring solutions.

Impact on Testing

When performing live testing on a real device, secure screens may not be visible through the remote device stream. As a result, you may be unable to view or interact with screens protected by FLAG_SECURE. On the contrary, automated tests can typically continue to execute on secure screens. However, any video recordings, screenshots, or visual artifacts generated during the test may show blank or blacked-out content while a secure screen is displayed.

Available Solutions

Option 1: Use a Special Test Build

If you develop the application, the recommended approach is to provide a dedicated testing build in which FLAG_SECURE is disabled for selected screens. This allows both live testing and automated testing to proceed without secure-screen restrictions while maintaining the security settings in production builds.

Option 2: App Instrumentation by webmate

For Android applications, we can instrument the application package (APK) to disable secure-screen restrictions. To use this option:

  • Upload the application package to webmate.

  • webmate will generate an instrumented version of the app.

  • Install the instrumented version on the target device through webmate.

This approach allows testing of screens that would otherwise be protected by FLAG_SECURE.

Option 3: Contact Support

If secure screens prevent you from performing your tests, contact the support team through webmate to manually bypass the secure screen for you.

Limitations

The available options depend largely on how the application was developed. Applications developed by you can often be modified to disable FLAG_SECURE in dedicated testing builds. Third-party applications or applications built on external platforms may offer limited or no ability to remove secure-screen restrictions.