English

# LIFF app development guidelines

When developing web apps using LIFF, follow these development guidelines.

Note

The basic rules for LIFF development are based on the content described in Terms and Policies.

# Be sure to securely handle user data

  • When using user data in LIFF apps and servers, the LIFF app will be vulnerable to spoofing and other types of attacks if it doesn't properly handle the user data. For more information on how LIFF apps and servers can securely use user data obtained from LIFF apps, see Using user data in LIFF apps and servers.
  • LIFF endpoint URLs and URL fragments of LIFF URLs contain sensitive information such as access tokens and user IDs, so be careful of data leakage.

# Cautions for initializing LIFF apps

Don't change the URL during server or front-end processing before the Promise object returned by the liff.init() method is resolved. If you change the URL, it will return INIT_FAILED and the LIFF app can't be opened. For more information on other precautions when initializing the LIFF app, see Initializing the LIFF app.

# LIFF app development rules

  • To build a LIFF app as an SPA (single page application), use the History API (opens new window). LIFF has limited compatibility with routing using fragments.
  • When you implement an API that uses any of the device or OS functions listed below, implement the API so that user actions trigger API calls.
    • Getting location information
    • Accessing the camera
    • Accessing the microphone
  • Do not track a user with cookies, localStorage, or sessionStorage or link LINE user data with external session information without getting the user's consent.
  • While you can use cookies, localStorage, or sessionStorage with the LIFF app, their use may be restricted in the future.
  • During your application's test phase, limit access privileges for the LIFF app through your web app.
  • The URL scheme of the LIFF app and any content that is opened in the LIFF app must be https. If the URL scheme is http, the content is displayed in LINE's in-app browser. In this case, even if the web app has been registered as a LIFF app, it does not function as a LIFF app.

# Prohibiting mass requests to the LINE Platform

Do not access the LIFF app via the LIFF scheme (https://liff.line.me/{liffId}) or request a large amount of LIFF API for load testing purposes. For load testing LIFF apps, prepare a test environment that doesn't generate a large number of requests to the LINE Platform.

Note

If the rate limit is exceeded, 429 Too Many Requests will be returned and an error will occur.