M03: Insecure Authentication/Authorization

📋 What Is It?

Insecure Authentication/Authorization occurs when mobile applications fail to properly verify user identity or enforce access controls. This includes weak authentication schemes, missing session management, broken authorization checks, and client-side enforcement of security controls. Mobile apps must handle authentication securely despite operating in untrusted environments.

M03 OWASP Rank

71% Apps Affected

<2hrs Time to Exploit

⚠️ Common Exploits

Client-Side Bypass: Modify app logic to skip authentication
Weak Password Policy: Brute force weak credentials
Session Hijacking: Steal or reuse session tokens
Biometric Bypass: Circumvent fingerprint/face authentication
Authorization Bypass: Access restricted features via API calls
Token Manipulation: Modify JWT tokens or claims

🔴 Attack Flow

1. Attacker analyzes authentication flow
↓
2. Identifies client-side validation only
↓
3. Uses Frida to hook authentication check
↓
4. Forces method to return "authenticated"
↓
5. BREACH: Full app access without credentials!

❌ Vulnerable Code

// Bad: Client-side authentication only (Android)
public boolean login(String username, String password) {
    // VULNERABLE: Authentication logic on client
    if (username.equals("admin") && password.equals("password123")) {
        SharedPreferences.edit().putBoolean("isLoggedIn", true).apply();
        return true;
    }
    return false;
}

// Bad: No session expiration
public boolean isAuthenticated() {
    // VULNERABLE: Token never expires
    return prefs.getString("auth_token", null) != null;
}

// Bad: Weak biometric implementation (iOS)
func authenticateWithBiometrics() {
    let context = LAContext()
    var error: NSError?
    
    // VULNERABLE: No fallback policy
    if context.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &error) {
        // Grants access if biometrics available
        grantAccess()
    }
}

// Bad: JWT not verified (Android)
public boolean checkAccess(String token) {
    // VULNERABLE: Decodes but doesn't verify signature
    String[] parts = token.split("\\.");
    String payload = new String(Base64.decode(parts[1]));
    JSONObject claims = new JSONObject(payload);
    return claims.getString("role").equals("admin");
}
                

✅ Secure Code

// Good: Server-side authentication (Android)
public void login(String username, String password) {
    // Send credentials to backend via HTTPS
    AuthRequest request = new AuthRequest(username, password);
    
    api.login(request).enqueue(new Callback<AuthResponse>() {
        public void onResponse(Response<AuthResponse> response) {
            if (response.isSuccessful()) {
                // Store token securely
                secureStorage.storeToken(response.body().getToken());
            }
        }
    });
}

// Good: Token expiration and refresh
public boolean isAuthenticated() {
    String token = secureStorage.getToken();
    if (token == null) return false;
    
    // Verify token hasn't expired
    if (isTokenExpired(token)) {
        // Attempt to refresh token
        refreshToken();
        return false;
    }
    
    // Verify token with backend
    return verifyTokenWithBackend(token);
}

// Good: Proper biometric implementation (iOS)
func authenticateWithBiometrics() {
    let context = LAContext()
    context.localizedFallbackTitle = "Use Passcode"
    
    context.evaluatePolicy(
        .deviceOwnerAuthentication,
        localizedReason: "Authenticate to access"
    ) { success, error in
        if success {
            // Verify with backend before granting access
            self.verifyAuthenticationWithBackend()
        } else {
            // Handle authentication failure
            self.handleAuthenticationError(error)
        }
    }
}

// Good: JWT verification with backend
public boolean checkAccess(String token) {
    // Always verify JWT signature server-side
    Response response = api.verifyToken(token);
    
    if (!response.isSuccessful()) {
        return false;
    }
    
    // Backend validates signature, expiration, and claims
    return response.body().isValid();
}
                

✓ Prevention Checklist

Perform all authentication server-side, never client-side
Implement strong password policies and MFA
Use secure session management with expiration
Implement account lockout after failed attempts
Use OAuth 2.0 or OpenID Connect for authentication
Properly implement biometric authentication with fallback
Verify JWT signatures and claims server-side
Implement certificate pinning for API calls
Never store passwords, only hashed values server-side
Log and monitor authentication failures

🔍 Detection & Tools

Testing Tools:

Frida Objection Burp Suite OWASP ZAP MobSF Drozer

Implementation Tools:

Firebase Auth Auth0 Okta AWS Cognito AppAuth

How to Test:

Use Frida to hook authentication functions
Intercept API traffic with Burp Suite/ZAP
Test with expired/invalid tokens
Attempt to access features without authentication
Test biometric bypass on rooted/jailbroken devices
Verify session timeout and token rotation

🌍 Real-World Breaches

Banking App (2020): Client-side PIN verification bypassed with Frida
E-commerce App (2019): JWT signature not verified, allowed privilege escalation
Social Media App (2021): Tokens never expired, enabling long-term account access
Healthcare App (2018): Biometric bypass on jailbroken devices exposed patient data
Fintech App (2020): Missing session timeout led to unauthorized transactions

📌 Quick Tips

DO NOT implement authentication client-side only
DO NOT trust client-provided tokens without verification
DO NOT skip session expiration
DO validate all auth server-side
DO implement MFA for sensitive operations
DO use industry-standard auth protocols (OAuth 2.0)

📜 Compliance

Related Standards:

PCI-DSS Requirement 8.1-8.3
GDPR Art. 32 - Security of Processing
HIPAA §164.312(a)(2)(i)
NIST 800-53 IA-2, IA-5
OWASP MASVS MSTG-AUTH-1 to 12
ISO 27001 A.9.2.1, A.9.4.2

🚪 Insecure Authentication/Authorization