Lesson 5 of 6 · 7 min read
Signing In From a Mobile App: OAuth for Native Apps
A mobile app cannot keep a client secret, so OAuth treats it as a public client. RFC 8252 sets the pattern: run the login in the system browser or a platform authentication session, never an embedded WebView; receive the code on a redirect the OS verifies, such as an App Link or universal link; and protect the code with PKCE using S256. RFC 9700 adds that public clients must use PKCE and that their refresh tokens must be rotated or bound to a key, which on a phone can live in secure hardware.
free sign-in, no card required
Practise it as an interviewer asks it
What is the difference between authentication and authorization, and where does each usually fail?Compare the Android and iOS security models. What does each platform guarantee an app, and what does it not?How does the OAuth 2.0 authorization code flow with PKCE work, and what attacks does each part stop?How does the Android application sandbox work, and what role do app signing and permissions play?What is the difference between OpenID Connect and OAuth, and between an ID token and an access token?What are OWASP MASVS and MASTG, and how would you use them to scope a mobile app assessment?