Skip to content

DEV Community

Discussion on: How I Fixed JWT Security Flaws in 3 Steps

View post

Replies for: Hi! Nice article! Regarding #2, you're assuming that it's a browser on the client side (so that you can use a cookie). In the case of a mobile app...

Renato Byrro • Oct 14 '19 • Edited

Hey Alexandre, thanks for stopping by!

That's correct, the advice assumes the client is a web browser.

I don't have experience with native mobile apps at all. But I found potentially useful references:

OWASP guide on mobile app authentication
This question on StackOverflow addresses this issue on Android. It seemed to me that the AccountManager resource would be the equivalent to safe cookies on this case? My lack of expertise on the area can't give me enough assurance.
This other resource indicates that SharedPreferences is the alternative to go on Android, and Keychain is the equivalent for Apple iOS apps.

Again. Not my area of expertise. These are just what seemed to be relevant to me from a quick web search. Use with caution! 😉

(saudações de Minas, Brasil! 😄)