Mobile App Developer
Web application security questions
33 questions on Web application security for mobile app developers, easiest first.
Easy 10
- Secret key in the app codeeasy
- HTTP request blocked on iOSeasy
- Blocking screenshots of sensitive screenseasy
- Logging the login requesteasy
- Copying a one-time passwordeasy
- A standard for mobile app securityeasy
- What to clear on logouteasy
- Validation only in the appeasy
- HTTP request blockedeasy
- Refresh token in UserDefaultseasy
Medium 12
- Sharing a PDF with another appmedium
- Checking app integritymedium
- EXPO_PUBLIC variables and secretsmedium
- OAuth login from a mobile appmedium
- Cleartext HTTP fails on Androidmedium
- Trusting a debug proxy only in debugmedium
- What R8 obfuscation gives youmedium
- Encrypting a local databasemedium
- Sensitive data in device backupsmedium
- Deep link sets the payment amountmedium
- Adding a free analytics SDKmedium
- Card number in the app switchermedium
Hard 11
- Refreshing an expired tokenhard
- Decryption fails after new fingerprinthard
- Trusting the phone's clockhard
- Login page inside a WebViewhard
- Detecting a stolen refresh tokenhard
- Relying on jailbreak detectionhard
- Exposing native code to a WebViewhard
- Attacker installs a CA certificatehard
- Overlay tricks the user into tappinghard
- Biometric login that can be bypassedhard
- Reading roles from a JWT in the apphard