Mobile Security and Authentication
Mobile Security and Authentication
This domain tests authentication flows, token handling, transport security, and protecting local data in OutSystems mobile apps.
Core rules
- Use OutSystems authentication actions and a User Provider; do not build password storage yourself.
- Store tokens and secrets in secure storage (keychain/keystore), not in client variables or plain local storage.
- Enforce HTTPS; configure certificate pinning through Extensibility Configurations where required.
- Handle token expiry and logout: clear local session data and navigate to the login screen.
- Apply least-privilege permissions and validate authorization on the server, not only in the UI.
- Consider biometrics as a local gate, not as a replacement for server-side authorization.
Worked example
A login screen calls a Server Action that authenticates against an OAuth provider and returns a short-lived access token. The Client Action stores the token in secure storage, attaches it to API calls, and schedules refresh before expiry. On refresh failure, clear the token and redirect to login. Reasoning: the server remains the authority; the device only holds a revocable credential.
Traps
- Hardcoding client secrets in the app.
- Storing tokens in client variables or Local Entities.
- Trusting a hidden button as authorization.
- Ignoring certificate pinning after a domain change.
- Not clearing cached user data on logout.