All guides · Page 8
Browse by topic, or search for a specific concept, tool or platform.
Preserving TLS verification in mobile clients
TLS protects connection confidentiality and integrity only when certificate verification works. Accepting every certificate removes that trust.
Read the guideDoes a mobile application need certificate pinning?
Pinning adds restrictions for some threat models but can complicate certificate changes and availability. It is not an automatic requirement for every application.
Read the guideBackup pins and certificate transition planning
Changing a pinned key changes the application's trust model. A backup pin should represent a deliberately authorized future transition.
Read the guidemTLS and device certificates in mobile apps
mTLS authenticates clients with certificates. Design enrollment, private-key protection and revocation together.
Read the guideObject ownership and BOLA in mobile APIs
Hiding an object in the interface does not make it inaccessible through an API. Verify ownership or access rights on every request.
Read the guideAPI function authorization and mobile roles
A hidden administration button does not protect the administration endpoint. Enforce function-level permissions in the API.
Read the guideDesigning mobile API rate limits
Rate limits reduce excessive use, but IP-only limits can affect many legitimate mobile users together.
Read the guideIdempotency and mobile transaction retries
Network failures can cause clients to resend operations. The server must distinguish a retry from a new business request.
Read the guideWhich fields should a mobile request signature cover?
A signature protects only included fields. Omitting critical business data can leave a valid signature attached to the wrong operation.
Read the guideCanonical representation for JSON requests
Equivalent business data can have different textual forms. Hashing and signing need a shared representation to avoid ambiguity and false rejection.
Read the guideSession security for mobile WebSockets
An open connection does not mean authority remains unchanged. WebSocket messages still require identity and function checks.
Read the guideField and object controls in mobile GraphQL APIs
Flexible GraphQL queries make field authorization and query-cost controls particularly important.
Read the guideSecurity contracts for mobile gRPC clients
Binary messages are not secure merely because they are harder to read. Establish identity, transport protection and method authorization explicitly.
Read the guideDNS and certificate trust in mobile connections
DNS resolves a name to a destination; TLS still needs to verify that the application reached the intended service.
Read the guideSeparating enterprise proxies from mobile test inspection
Proxies may be normal on enterprise networks. Define distinct trust and distribution policies for production and authorized laboratory observation.
Read the guideCaptive portals and secure connection failures
Hotel or airport Wi-Fi can appear connected while requiring a portal login. Do not solve that condition by disabling certificate checks.
Read the guideCache policy for mobile API responses
Headers affect storage by clients, intermediaries and CDNs. Defaults may be inappropriate for account-specific data.
Read the guideSecurity boundaries in mobile file uploads
A file picker does not make server input trustworthy. Enforce size, format, ownership and processing rules server-side.
Read the guideProtecting time-limited download URLs
A presigned URL can grant temporary resource access to whoever holds it. Treat the URL itself as sensitive.
Read the guidePagination and bulk-data access
List endpoints can disclose data that individual-object checks correctly protect. Pagination parameters must not expand authority.
Read the guidePreventing information leaks in mobile API errors
Errors should guide users without exposing internal server details. Keep stack traces and secret configuration out of responses.
Read the guideClock skew in request verification
Device clocks may differ because of users or system conditions. Validate timed evidence using trusted server time and explicit tolerance.
Read the guideRetries and backoff for security services
Uncontrolled retries can worsen temporary failures. Design mobile verification retries within a total latency budget.
Read the guidePassing attestation decisions through an API gateway
Gateway verification can provide shared evidence to services. Preserve the decision's integrity across the internal network.
Read the guideCircuit breakers for protection services
Repeated calls to a failing dependency can slow the entire application. Circuit breakers help control that failure behavior.
Read the guideWhy mobile OAuth uses PKCE
Mobile applications are distributed public clients; embedded shared secrets cannot remain confidential. PKCE binds authorization-code exchange to the initiating flow.
Read the guideUsing the system browser for mobile sign-in
A system browser or suitable platform authentication session helps keep the user's password out of the application's direct control.
Read the guideRegistering OAuth redirect URIs securely
Redirect URIs determine where authentication results return. Broad matching or uncontrolled destinations weaken the flow.
Read the guideID tokens versus access tokens
ID tokens describe authentication context; access tokens authorize access to resources. Interchanging them without regard to purpose causes validation errors.
Read the guideRotating mobile refresh tokens
A stolen long-lived refresh token can prolong account access. Rotation and reuse detection help manage that risk.
Read the guideRevoking mobile sessions remotely
Remote revocation helps with lost devices and suspicious activity. Its effect extends beyond a logout message.
Read the guideProtecting Android passkey integration
Passkeys can reduce password use, but account binding and server validation still need correct implementation. Credential Manager supports the platform experience.
Read the guideiOS passkeys and application identity
Passkeys form part of the application-service identity flow. Assess registration, sign-in and recovery together.
Read the guideRecovery policies for passkey accounts
A strong sign-in method loses value if a weaker recovery route permits takeover. Recovery deserves equal attention.
Read the guideStep-up verification for sensitive transactions
Different actions need different assurance. Step-up rechecks identity or approval for higher-risk operations.
Read the guideDevice binding and account registration
Device binding links accounts to specific registrations. It is distinct from collecting hardware identifiers; key-based registration may be suitable.
Read the guideWhat DPoP adds to mobile access tokens
DPoP binds OAuth tokens to proof of key possession, adding a constraint against token copying alone.
Read the guideValidating JWT claims in mobile APIs
Reading JWT fields is not validation. Verify signatures together with expected issuer and audience.
Read the guideWhere to store mobile access tokens
Storage depends on lifetime, background needs and device-loss risk. Plain preferences and protected platform storage offer different properties.
Read the guideIs local biometrics proof of identity to a server?
Local biometrics authenticates interaction with the device user. A client-supplied success field is not sufficient account evidence.
Read the guideSMS codes and mobile account security
SMS can add verification, but numbers change ownership and codes can be socially engineered. Account for these limits in sensitive flows.
Read the guideTime and recovery in TOTP flows
TOTP generates time-based codes. Validation needs defined windows, replay handling and recovery.
Read the guideUnintended approval in push authentication
Repeated prompts can encourage thoughtless acceptance. Show clearly which request is being approved.
Read the guideProtecting mobile password reset
Reset restores account control and is therefore a security flow, not a minor auxiliary page.
Read the guideSupport-team authority in account recovery
Support recovery can become a separate route around technical controls. It needs evidence, bounded privileges and records.
Read the guideIdle timeouts in mobile sessions
Idle duration, absolute session lifetime and transaction approval are different time limits. Choose them for the use case.
Read the guideSeparating multiple mobile accounts safely
Multiple accounts require explicit ownership of caches, keys and tasks. Changing the displayed username is insufficient.
Read the guideCombining risk signals with authentication
Device and application risk can inform authentication. A signal does not prove malicious intent.
Read the guideSeparating login from transaction authorization
Signing in does not approve every sensitive action. Bind authorization to specific content and user intent.
Read the guideAccount deletion and security-data lifecycle
Deletion combines identity, retention and session revocation. One user must not be able to delete another's account.
Read the guide