Working with Mobile Authentication
1. Understanding Mobile Auth Challenges
| Challenge | Detail |
|---|
| No browser cookies | Use tokens stored in OS secure storage |
| App lifecycle | Long-lived refresh tokens needed |
| URL hijacking | Custom schemes vulnerable; prefer App Links/Universal Links |
| Reverse engineering | Secrets in app are public — use PKCE not client secret |
2. Implementing Deep Linking for OAuth
| Platform | Recommended |
|---|
| iOS | Universal Links (HTTPS-verified) |
| Android | App Links (assetlinks.json) |
| Fallback | Custom scheme only when verified links unavailable |
3. Using Custom URL Schemes
Warning: Any app can register a custom scheme — vulnerable to interception. Always combine with PKCE.
4. Implementing App-to-App Authentication
| Mechanism | Detail |
|---|
| iOS | ASWebAuthenticationSession + Universal Link |
| Android | Custom Tabs + App Link |
| SSO | SDK shares token via Keychain group / Account Manager |
5. Working with System Webview
| Platform | API |
|---|
| iOS | ASWebAuthenticationSession (RFC 8252) |
| Android | Custom Tabs |
| Cookies | Shared with system browser → SSO |
| Avoid | Embedded WebView (no SSO, phishing risk) |
6. Using In-App Browsers
Warning: RFC 8252 mandates external user agent (Custom Tabs / ASWebAuthenticationSession) for OAuth, not embedded WebView.
7. Implementing Secure Storage
| Platform | API |
|---|
| iOS | Keychain Services (kSecAttrAccessibleAfterFirstUnlock) |
| Android | EncryptedSharedPreferences / Jetpack Security; backed by StrongBox/TEE |
| Cross-platform | react-native-keychain, expo-secure-store, flutter_secure_storage |
8. Using Biometric Authentication
| Platform | API |
|---|
| iOS | LocalAuthentication (LAContext) |
| Android | BiometricPrompt (androidx.biometric) |
| Key binding | Keychain/Keystore key requires biometric to use |
9. Implementing Refresh Tokens in Mobile
| Practice | Detail |
|---|
| Storage | Keychain/Keystore, encrypted at rest |
| Rotation | Replace on every use |
| Reuse detection | Revoke family on duplicate use |
| DPoP / sender-constrained | Bind to device-generated key |
10. Handling Background Token Expiration
| Strategy | Detail |
|---|
| Refresh on resume | App foreground → refresh if < 5min left |
| Background fetch | iOS BGTaskScheduler / Android WorkManager |
| Push notification | Wake app to refresh before expiry |
11. Implementing Certificate Pinning
| Method | Detail |
|---|
| Static pin | SPKI hash in code/config |
| iOS | ATS + URLSessionDelegate challenge handler |
| Android | NetworkSecurityConfig pin set |
| Backup pin | Required for rotation; otherwise app bricks |
| Remote update | Signed pin updates via OTA config |