Securing Mobile API Backends
Mobile applications communicate with backend APIs over potentially hostile networks. Unlike web applications where the browser enforces security policies, mobile apps run on user-controlled devices where attackers can easily intercept, modify, and replay traffic.
Key Security Challenges
Certificate Pinning
Prevent MITM attacks by validating the server's certificate:// iOS - URLSession certificate pinning
func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge) {
let serverCert = challenge.protectionSpace.serverTrust
let pinnedCert = loadPinnedCertificate()
if serverCert == pinnedCert {
// Allow connection
} else {
// Reject connection
}
}
API Key Protection
Mobile API keys are extractable from app binaries:- Never use API keys as sole authentication
- Implement app attestation (Play Integrity, App Attest)
- Use short-lived tokens with refresh mechanisms
- Rate limit per device ID, not just per key
Request Signing
Sign API requests to prevent tampering:signature = HMAC-SHA256(
key: session_key,
data: method + path + timestamp + body_hash
)
Anti-Reverse Engineering
Protect the mobile app from analysis:- Code obfuscation (ProGuard, R8, SwiftShield)
- Root/jailbreak detection
- Debugger detection
- Integrity verification
OAuth for Mobile
Authorization Code + PKCE (Required)
1. Generate code_verifier (43-128 chars, random)
2. code_challenge = SHA256(code_verifier)
3. Authorization request with code_challenge
4. Exchange code with code_verifier (proves original requestor)
Token Storage
- iOS: Keychain Services with appropriate access level
- Android: EncryptedSharedPreferences or Keystore
- Never: SharedPreferences, plist, or local storage
Where SuperClue Fits
SuperClue's DAST scanner tests mobile backend APIs for authentication weaknesses and API abuse patterns, the same way it tests any web API. It does not analyze the mobile app itself, so certificate pinning bypass is out of scope.