domains / families / security / testing-mobile-api-authentication

testing-mobile-api-authentication

separate

'Tests authentication and authorization mechanisms in mobile application

When to use

• Assessing mobile app backend API authentication during penetration tests
• Testing JWT token implementation for common vulnerabilities (none algorithm, weak signing)
• Evaluating OAuth 2.0 / OIDC flows in mobile applications for redirect, PKCE, and scope issues
• Testing for broken object-level authorization (BOLA/IDOR) in API endpoints

When not to use

• Production APIs without explicit authorization
• Production APIs without rate-limiting awareness

Skill page

Source