Network and API protection
TLS, authorization, request integrity, caching and network failures.
Preserving TLS verification in mobile clients
TLS protects connection confidentiality and integrity only when certificate verification works. Accepting every certificate removes that trust.
Read the guideDoes a mobile application need certificate pinning?
Pinning adds restrictions for some threat models but can complicate certificate changes and availability. It is not an automatic requirement for every application.
Read the guideBackup pins and certificate transition planning
Changing a pinned key changes the application's trust model. A backup pin should represent a deliberately authorized future transition.
Read the guidemTLS and device certificates in mobile apps
mTLS authenticates clients with certificates. Design enrollment, private-key protection and revocation together.
Read the guideObject ownership and BOLA in mobile APIs
Hiding an object in the interface does not make it inaccessible through an API. Verify ownership or access rights on every request.
Read the guideAPI function authorization and mobile roles
A hidden administration button does not protect the administration endpoint. Enforce function-level permissions in the API.
Read the guideDesigning mobile API rate limits
Rate limits reduce excessive use, but IP-only limits can affect many legitimate mobile users together.
Read the guideIdempotency and mobile transaction retries
Network failures can cause clients to resend operations. The server must distinguish a retry from a new business request.
Read the guideWhich fields should a mobile request signature cover?
A signature protects only included fields. Omitting critical business data can leave a valid signature attached to the wrong operation.
Read the guideCanonical representation for JSON requests
Equivalent business data can have different textual forms. Hashing and signing need a shared representation to avoid ambiguity and false rejection.
Read the guideSession security for mobile WebSockets
An open connection does not mean authority remains unchanged. WebSocket messages still require identity and function checks.
Read the guideField and object controls in mobile GraphQL APIs
Flexible GraphQL queries make field authorization and query-cost controls particularly important.
Read the guideSecurity contracts for mobile gRPC clients
Binary messages are not secure merely because they are harder to read. Establish identity, transport protection and method authorization explicitly.
Read the guideDNS and certificate trust in mobile connections
DNS resolves a name to a destination; TLS still needs to verify that the application reached the intended service.
Read the guideSeparating enterprise proxies from mobile test inspection
Proxies may be normal on enterprise networks. Define distinct trust and distribution policies for production and authorized laboratory observation.
Read the guideCaptive portals and secure connection failures
Hotel or airport Wi-Fi can appear connected while requiring a portal login. Do not solve that condition by disabling certificate checks.
Read the guideCache policy for mobile API responses
Headers affect storage by clients, intermediaries and CDNs. Defaults may be inappropriate for account-specific data.
Read the guideSecurity boundaries in mobile file uploads
A file picker does not make server input trustworthy. Enforce size, format, ownership and processing rules server-side.
Read the guideProtecting time-limited download URLs
A presigned URL can grant temporary resource access to whoever holds it. Treat the URL itself as sensitive.
Read the guidePagination and bulk-data access
List endpoints can disclose data that individual-object checks correctly protect. Pagination parameters must not expand authority.
Read the guidePreventing information leaks in mobile API errors
Errors should guide users without exposing internal server details. Keep stack traces and secret configuration out of responses.
Read the guideClock skew in request verification
Device clocks may differ because of users or system conditions. Validate timed evidence using trusted server time and explicit tolerance.
Read the guideRetries and backoff for security services
Uncontrolled retries can worsen temporary failures. Design mobile verification retries within a total latency budget.
Read the guidePassing attestation decisions through an API gateway
Gateway verification can provide shared evidence to services. Preserve the decision's integrity across the internal network.
Read the guideCircuit breakers for protection services
Repeated calls to a failing dependency can slow the entire application. Circuit breakers help control that failure behavior.
Read the guide