Mobile apps communicate with backend services over networks that may be monitored or compromised. Insecure communication includes using HTTP instead of HTTPS, improper certificate validation, or weak encryption. Attackers on the same network can intercept and modify traffic through man-in-the-middle attacks.
Enforce TLS 1.2+ for all network communications. Implement certificate pinning to prevent MITM attacks. Validate server certificates properly and avoid accepting self-signed certificates in production. Encrypt sensitive data before transmission as an additional layer.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2024Latest
#03mobile03-2024 Insecure Authentication/Authorization
No change since 20162016
#03Insecure Communication
