How would you implement secure login with an OAuth or OpenID Connect provider in a mobile app?
What the interviewer wants to hear
- Use the authorization code flow with PKCE; no client secret in the app
- Use the system browser (ASWebAuthenticationSession, Custom Tabs), not a WebView
- Validate state and use verified redirect URIs
- Store tokens securely and use short-lived access tokens with refresh
- Handle refresh races, revocation and logout
Model answer
A mobile app is a public client, so it cannot keep a client secret. I use the authorization code flow with PKCE: the app creates a random code verifier, sends its hash with the authorization request, and proves possession when exchanging the code for tokens, so an intercepted code is useless. The login page opens in the system browser through ASWebAuthenticationSession or Android Custom Tabs, never an embedded WebView, so the app cannot see the password and the user gets shared sessions and password managers. I check the state parameter and use verified https redirects where possible. Libraries like AppAuth handle these details. Tokens are stored in the Keychain or Keystore-backed storage, access tokens are short-lived, and refresh happens in one place with a lock to avoid races. Logout revokes tokens on the server and clears local data.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Mobile App Developer questions
- How would you design the mobile client for a chat app like WhatsApp?
- Your app has grown to 40 developers and one huge module. Builds are slow and teams block each other. How would you restructure it?
- A delivery app must track the rider location all day. How do you balance accuracy with battery life and OS limits?
- In a Flutter or React Native app, you need a feature that only exists in native SDKs, such as a payment terminal SDK. How would you integrate it well?
- How would you measure and improve app performance for real users in production, not just on your test phone?
- Users keep running old versions of your app for months. How do you evolve the API and decide when to force an update?
- Your crash reports show rising out-of-memory crashes after a release. How do you find and fix the problem?
- How would you migrate a large UIKit or Android View app to SwiftUI or Jetpack Compose without stopping feature work?
- Millions of users have data in your app local database. How do you change the schema safely?