Mobile App Security Best Practices for 2026

📋 Table of Contents

• 1. OWASP Mobile Top 10 (2024)
• 2. Secure Data Storage
• 3. Network Security and Certificate Pinning
• 4. Authentication and Biometrics
• 5. API Security
• 6. Code Protection and Obfuscation
• 7. Runtime Protection
• 8. Security Checklist
• 9. FAQ

// Android — secure token storage
import androidx.security.crypto.EncryptedSharedPreferences
import androidx.security.crypto.MasterKey

class SecureTokenStore(context: Context) {
    private val masterKey = MasterKey.Builder(context)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
        .build()

    private val prefs = EncryptedSharedPreferences.create(
        context,
        "secure_prefs",
        masterKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
    )

    fun saveToken(token: String) {
        prefs.edit().putString("auth_token", token).apply()
    }

    fun getToken(): String? = prefs.getString("auth_token", null)

    fun clearToken() {
        prefs.edit().remove("auth_token").apply()
    }
}

// iOS — Keychain wrapper for secure storage
import Security

struct KeychainHelper {
    static func save(key: String, data: Data) throws {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
        ]

        SecItemDelete(query as CFDictionary)  // Remove existing
        let status = SecItemAdd(query as CFDictionary, nil)

        guard status == errSecSuccess else {
            throw KeychainError.saveFailed(status)
        }
    }

    static func load(key: String) throws -> Data? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]

        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)

        guard status == errSecSuccess else { return nil }
        return result as? Data
    }
}

<!-- res/xml/network_security_config.xml -->
<network-security-config>
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">api.yourapp.com</domain>
        <pin-set expiration="2027-01-01">
            <!-- Pin the intermediate CA certificate (not leaf) -->
            <pin digest="SHA-256">YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=</pin>
            <!-- Backup pin (different CA) for rotation -->
            <pin digest="SHA-256">sRHdihwgkaib1P1gN7akqREHQMk5nOSeltDep3DcZhA=</pin>
        </pin-set>
    </domain-config>
</network-security-config>

// iOS — Certificate pinning with URLSessionDelegate
class PinnedSessionDelegate: NSObject, URLSessionDelegate {
    private let pinnedHashes: Set<String> = [
        "YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=",
        "sRHdihwgkaib1P1gN7akqREHQMk5nOSeltDep3DcZhA="
    ]

    func urlSession(
        _ session: URLSession,
        didReceive challenge: URLAuthenticationChallenge
    ) async -> (URLSession.AuthChallengeDisposition, URLCredential?) {
        guard let serverTrust = challenge.protectionSpace.serverTrust,
              let certificate = SecTrustCopyCertificateChain(serverTrust)?.first
        else {
            return (.cancelAuthenticationChallenge, nil)
        }

        let serverHash = sha256Hash(of: SecCertificateCopyPublicKey(certificate)!)

        if pinnedHashes.contains(serverHash) {
            return (.useCredential, URLCredential(trust: serverTrust))
        }

        return (.cancelAuthenticationChallenge, nil)
    }
}

// Android — BiometricPrompt with Keystore-backed crypto
class BiometricAuthManager(private val activity: FragmentActivity) {

    fun authenticate(onSuccess: (BiometricPrompt.CryptoObject) -> Unit) {
        val promptInfo = BiometricPrompt.PromptInfo.Builder()
            .setTitle("Verify your identity")
            .setSubtitle("Use fingerprint or face to continue")
            .setNegativeButtonText("Use PIN instead")
            .setAllowedAuthenticators(BiometricManager.Authenticators.BIOMETRIC_STRONG)
            .build()

        val biometricPrompt = BiometricPrompt(
            activity,
            ContextCompat.getMainExecutor(activity),
            object : BiometricPrompt.AuthenticationCallback() {
                override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
                    result.cryptoObject?.let { onSuccess(it) }
                }

                override fun onAuthenticationFailed() {
                    // Biometric didn't match — prompt stays open for retry
                }

                override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
                    // Fatal error — fallback to PIN/password
                }
            }
        )

        // Use Keystore-backed cipher for actual cryptographic guarantee
        val cipher = getCipherForEncryption()  // AES/GCM with Keystore key
        biometricPrompt.authenticate(promptInfo, BiometricPrompt.CryptoObject(cipher))
    }
}

// Request signing — HMAC per request
fun signRequest(
    method: String,
    path: String,
    body: String?,
    sessionKey: ByteArray
): String {
    val timestamp = System.currentTimeMillis() / 1000
    val nonce = UUID.randomUUID().toString()

    val payload = buildString {
        append("$method\n")
        append("$path\n")
        append("$timestamp\n")
        append("$nonce\n")
        append(body?.sha256() ?: "")
    }

    val mac = Mac.getInstance("HmacSHA256")
    mac.init(SecretKeySpec(sessionKey, "HmacSHA256"))
    val signature = Base64.encodeToString(mac.doFinal(payload.toByteArray()), Base64.NO_WRAP)

    return "ts=$timestamp,nonce=$nonce,sig=$signature"
}

// Android — R8 ProGuard rules for security
// proguard-rules.pro

# Obfuscate everything by default
-dontoptimize
-keepattributes SourceFile,LineNumberTable  # For crash reports

# Keep only what's needed
-keep class com.yourapp.api.models.** { *; }  # API models (serialization)
-keep class * extends androidx.lifecycle.ViewModel  # ViewModels

# Encrypt strings containing API endpoints
# (Use DexGuard for production, or move to BuildConfig/server)

// Android — basic root detection
fun isDeviceRooted(): Boolean {
    val rootIndicators = listOf(
        "/system/app/Superuser.apk",
        "/system/xbin/su",
        "/system/bin/su",
        "/sbin/su",
        "/data/local/xbin/su"
    )
    return rootIndicators.any { File(it).exists() } ||
           Build.TAGS?.contains("test-keys") == true
}

// Android — screenshot prevention + background blur
class SecureActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        // Prevent screenshots and screen recording
        window.setFlags(
            WindowManager.LayoutParams.FLAG_SECURE,
            WindowManager.LayoutParams.FLAG_SECURE
        )
    }
}

// iOS — background snapshot protection
class SceneDelegate: UIResponder, UIWindowSceneDelegate {
    private var blurView: UIVisualEffectView?

    func sceneWillResignActive(_ scene: UIScene) {
        // Add blur when entering background
        let blur = UIBlurEffect(style: .light)
        blurView = UIVisualEffectView(effect: blur)
        blurView?.frame = window?.bounds ?? .zero
        window?.addSubview(blurView!)
    }

    func sceneDidBecomeActive(_ scene: UIScene) {
        blurView?.removeFromSuperview()
        blurView = nil
    }
}

Pre-Release Security Checklist

• ☐ No hardcoded API keys, secrets, or credentials in source code
• ☐ Sensitive data stored in Keychain (iOS) / EncryptedSharedPreferences (Android)
• ☐ TLS 1.2+ enforced, cleartext traffic disabled
• ☐ Certificate pinning implemented with backup pins
• ☐ Auth tokens are short-lived with refresh rotation
• ☐ Biometric auth uses CryptoObject (not just UI gate)
• ☐ All inputs validated server-side (not just client-side)
• ☐ R8/ProGuard obfuscation enabled (Android release builds)
• ☐ Debug logging disabled in production builds
• ☐ No sensitive data in log output (grep for tokens, passwords, PII)
• ☐ Screenshot prevention on sensitive screens
• ☐ Background snapshot blurred for sensitive views
• ☐ Root/jailbreak detection implemented (at minimum, warning)
• ☐ Dependencies scanned for known vulnerabilities
• ☐ App Attest (iOS) / Play Integrity (Android) for API verification
• ☐ Deep links validated — no open redirect vulnerabilities

Related Articles