Mobile App Security

Mobile App Security

Security is paramount in mobile development. Users trust you with their data, and a breach can destroy your app's reputation. Let's learn essential security practices.

Security Threats

  ┌─────────────────────────────────────────────────┐
  │         Mobile Security Threats                 │
  ├─────────────────────────────────────────────────┤
  │                                                  │
  │  🔴 Insecure Data Storage                      │
  │     Storing sensitive data in plain text        │
  │                                                  │
  │  🔴 Man-in-the-Middle Attacks                  │
  │     Intercepting network communications         │
  │                                                  │
  │  🔴 Code Injection                             │
  │     Injecting malicious code                    │
  │                                                  │
  │  🔴 Reverse Engineering                        │
  │     Decompiling and stealing your code          │
  │                                                  │
  │  🔴 Insecure Authentication                     │
  │     Weak login mechanisms                       │
  │                                                  │
  └─────────────────────────────────────────────────┘

Essential Security Practices

// BAD: Storing sensitive data insecurely
AsyncStorage.setItem('token', userToken);  // DON'T DO THIS

// GOOD: Using secure storage
import * as Keychain from 'react-native-keychain';

// Store credentials securely
await Keychain.setGenericPassword('user@example.com', userToken);

// Retrieve credentials
const credentials = await Keychain.getGenericPassword();
if (credentials) {
  console.log('Token:', credentials.password);
}

// GOOD: Certificate pinning
import { Platform } from 'react-native';
import certificatePinning from 'react-native-ssl-pinning';

const fetchData = async () => {
  const response = await certificatePinning.fetch('https://api.example.com/data', {
    sslPinning: { certs: ['my_cert'] },
    timeoutInterval: 10000,
  });
  return response.json();
};

Flutter Security

import 'package:flutter_secure_storage/flutter_secure_storage.dart';

// Store sensitive data
final storage = FlutterSecureStorage();
await storage.write(key: 'token', value: userToken);

// Read sensitive data
String? token = await storage.read(key: 'token');

// Delete sensitive data
await storage.delete(key: 'token');

// GOOD: Use ProGuard/R8 for code obfuscation
// In android/app/build.gradle:
android {
    buildTypes {
        release {
            minifyEnabled true
            shrinkResources true
            proguardFiles getDefaultProguardFile('proguard-android.txt'),
                         'proguard-rules.pro'
        }
    }
}

Security Checklist

• HTTPS only: Never send data over HTTP
• Secure storage: Use Keychain (iOS) / EncryptedSharedPreferences (Android)
• Code obfuscation: Enable ProGuard/R8 for Android builds
• Input validation: Validate all user input on client and server
• Session management: Implement proper token expiration and refresh
• Jailbreak detection: Consider detecting compromised devices
• Dependency updates: Keep libraries updated to patch vulnerabilities