Use private mode in Appium scripts

Use kobiton:privateMode to keep private data, such as passwords and payment details, out of the session record of a Xium or basic Appium 2 automation session. While private mode is on, data from that part of the session is not recorded.

Private mode setting

Name Description Default value

Name	Description	Default value
`kobiton:privateMode`	Set to `true` to turn on private mode, or to `false` to turn it off. Use it as a capability to turn on private mode when the session starts, or as an Appium setting to turn private mode on and off during the session.	`false`

kobiton:privateMode

Set to true to turn on private mode, or to false to turn it off. Use it as a capability to turn on private mode when the session starts, or as an Appium setting to turn private mode on and off during the session.

false

Sessions that do not turn on private mode are recorded as usual.

Turn on private mode when the session starts

To keep the beginning of a session private, set the kobiton:privateMode capability to true.

Example (JavaScript)

const desiredCaps = {
  // other capabilities
  'kobiton:privateMode': true,
}

If you build the W3C capabilities request yourself, put kobiton:privateMode in alwaysMatch. When the request has alwaysMatch and kobiton:privateMode is only in firstMatch, the session starts with private mode off or the request is rejected.

Turn on private mode during the session

Before a test action that involves private data, such as entering an account password, use the Update Settings Appium command to set kobiton:privateMode to true.

Example (JavaScript)

await driver.updateSettings({'kobiton:privateMode': true})

Private mode stays on until the script turns it off or the session ends.

Turn off private mode

When test steps no longer involve private data, use the Update Settings Appium command to set kobiton:privateMode to false.

Before turning off private mode, leave or clear any screen that still shows private data. The first step after private mode is turned off captures the current screen.

Example (JavaScript)

await driver.updateSettings({'kobiton:privateMode': false})

After this command, session data is recorded again. You can turn private mode on and off as many times as needed in one session.

Examples

The following JavaScript example uses wd to sign in to a website, with private mode on while the username and password are entered.

Example (JavaScript)

import 'babel-polyfill'
import 'colors'
import wd from 'wd'
import {assert} from 'chai'

const username = process.env.KOBITON_USERNAME
const apiKey = process.env.KOBITON_API_KEY
const deviceUdid = process.env.KOBITON_DEVICE_UDID
const protocol = 'https'
const host = 'api.kobiton.com'

if (!username || !apiKey || !deviceUdid) {
  console.log('Error: Environment variables KOBITON_USERNAME, KOBITON_API_KEY or KOBITON_DEVICE_UDID are required to execute script')
  process.exit(1)
}

const kobitonServerConfig = {protocol, host, auth: `${username}:${apiKey}`}

const desiredCaps = {
  sessionName: 'Automation test with private mode',
  sessionDescription: 'An automation test that uses private mode for private data',
  udid: deviceUdid,
  noReset: true,
  fullReset: false,
  browserName: 'chrome',
  autoWebview: 'true',
}

let driver

function sleep(ms) {
  return new Promise((resolve) => setTimeout(resolve, ms))
}

describe('Android Web sample', () => {
  before(async () => {
    driver = wd.promiseChainRemote(kobitonServerConfig)

    driver.on('status', (info) => {
      console.log(info.cyan)
    })
    driver.on('command', (meth, path, data) => {
      console.log(' > ' + meth.yellow, path.grey, data || '')
    })
    driver.on('http', (meth, path, data) => {
      console.log(' > ' + meth.magenta, path, (data || '').grey)
    })

    try {
      await driver.init(desiredCaps)
    }
    catch (err) {
      if (err.data) {
        console.error(`init driver: ${err.data}`)
      }
      throw err
    }
  })

  it('should perform a simple login', async () => {
    await driver.settings()

    // Turn on private mode before passing username and password.
    await driver.updateSettings({'kobiton:privateMode': true})
    await driver.settings()

    // Send username and password to log in.
    await driver.get('https://the-internet.herokuapp.com/login')
     .waitForElementByName('username')
     .sendKeys('tomsmith')
     .sleep(1000)
     .waitForElementByName('password')
     .sendKeys('SuperSecretPassword!')
     .sleep(3000)
     .keys(wd.SPECIAL_KEYS.Enter)

    // Login completes. Turn off private mode.
    await driver.updateSettings({'kobiton:privateMode': false})
    await driver.settings()

    await driver.get('https://the-internet.herokuapp.com/')
    await sleep(2000)
    await driver.title()

  })

  after(async () => {
    if (driver != null) {
    try {
      await driver.quit()
    }
    catch (err) {
      console.error(`quit driver: ${err}`)
    }
  }
  })
})

Session data while private mode is on

While private mode is on, the following data is not recorded for that part of the session, even if other capabilities or settings request it:

Commands. Commands run while private mode is on do not appear in Session Explorer. The commands that turn private mode on and off are kept.
Session video. The video skips the private part of the session.
Screenshots and view trees (XML).
WebDriver request and response bodies.
Appium and Xium logs.
Device logs.
System metrics.
Network capture.

Accessibility and performance analysis does not run on the private part of the session.

The following continue to work while private mode is on:

The script receives errors as usual.
Crash logs are collected for troubleshooting.
The script receives real screenshots and page source from its own commands.
The live view of the session shows the device screen.

Limitations

Only supported in Xium and basic Appium 2 automation sessions.
Crash logs are kept while private mode is on and can contain app data.
When private mode is turned on by the capability, the device log can contain about 1 to 4 seconds of lines from the start of the session before private mode applies.
On iOS Safari, the first request after private mode is turned off can include the URL of the private page in its Referer header. This URL appears in the network capture.
Text that is still on screen when private mode is turned off is captured by the first step after it is turned off.
Automation sessions that use private mode are not marked as sensitive sessions and can be accessed by admins or other team members.