Android and iOS

Impersonating a mobile API client

Code tampering, account abuse, data exposure and client manipulation.

Threats and abuse1 min readEditorial methods

A request that resembles traffic from a mobile application is not inherently trustworthy. Verify application evidence, account authority and business data separately.

Evaluation approach

Authentication, object-level authorization, rate limits and application evidence are distinct controls. They do not all cover the same abuse path.

Application example

A script reproducing a legitimate request format must not gain full authority simply by supplying an application-version header.

Limits and considerations

RASP integration does not repair an API that omits object-ownership checks.

When a request looks like application traffic

Client-controlled fields such as User-Agent, package name or a fixed header do not establish trustworthy application identity. If the server uses cryptographic evidence, verify its scope and freshness. Enforce user authorization independently.

An attacker can learn the application's network contract. Keep operations secure without relying on that contract remaining secret. Requests from valid sessions still require object permissions and business-rule checks; API access must not depend on UI restrictions.

Checks and decisions

  • Verify the requester
  • Check resource permissions
  • Bind evidence to context

Assess application identity separately from user and transaction authority.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.