Attackers bypass the mobile UI entirely and talk to backend APIs with modified requests. Apps that hide admin features in the client, trust a local 'isLoggedIn' flag, accept offline PINs as proof of identity, or send user IDs without server-side ownership checks let an attacker escalate privileges or access other users' data.
Enforce every authentication and authorization decision on the server. Use platform biometrics only to unlock server-issued credentials, bind sessions to devices, expire and revoke tokens, and reject requests whose role or ownership claims are not verified server-side.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#03mobile03-2024 Insecure Authentication/Authorization
