testing-mobile-api-authentication

# Testing Mobile API Authentication ## When to Use Use this skill when: - Assessing mobile app backend API authentication during penetration tests - Testing JWT token implementation for common vulnerabilities (none algorithm, weak signing) - Evaluating OAuth 2.0 / OIDC flows in mobile applications for redirect, PKCE, and scope issues - Testing for broken object-level authorization (BOLA/IDOR) in API endpoints **Do not use** this skill against production APIs without explicit authorization and rate-limiting awareness. ## Prerequisites - Burp Suite or mitmproxy configured as mobile device proxy - SSL pinning bypassed on target application (if implemented) - Valid test account credentials for the target application - Postman or curl for API request crafting - jwt.io or PyJWT for JWT analysis and manipulation ## Workflow ### Step 1: Map Authentication Endpoints Intercept mobile app traffic to identify authentication-related endpoints: ``` POST /api/v1/auth/login - Initial authentication POST /api/v1/auth/register - Account registration POST /api/v1/auth/refresh - Token refresh POST /api/v1/auth/logout - Session termination POST /api/v1/auth/forgot-password - Password reset POST /api/v1/auth/verify-otp - OTP verification GET /api/v1/auth/me - Authenticated user profile ``` ### Step 2: Analyze Token Format and Security **JWT Analysis:** ```bash # Decode JWT without verification echo "eyJhbGciOiJIUzI1NiIs..." | cut -d. -f2 | ...