Mobile devices regularly join untrusted Wi-Fi networks where attackers can intercept traffic. Apps that allow HTTP, accept any certificate in debug code that reaches production, or ignore hostname verification let attackers read tokens and personal data or inject malicious responses.
Use TLS 1.2+ for every connection, disable cleartext traffic in Android Network Security Config and iOS App Transport Security, never override certificate validation, and pin certificates or public keys for high-value endpoints with a rotation plan.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#05mobile05-2024 Insecure Communication
