Testing Mobile API Authentication

When to Use

Use this skill when:

• Assessing mobile app backend API authentication during penetration tests
• Testing JWT token implementation for common vulnerabilities (none algorithm, weak signing)
• Evaluating OAuth 2.0 / OIDC flows in mobile applications for redirect, PKCE, and scope issues
• Testing for broken object-level authorization (BOLA/IDOR) in API endpoints

Do not use this skill against production APIs without explicit authorization and rate-limiting awareness.

Prerequisites

• Burp Suite or mitmproxy configured as mobile device proxy
• SSL pinning bypassed on target application (if implemented)
• Valid test account credentials for the target application
• Postman or curl for API request crafting
• jwt.io or PyJWT for JWT analysis and manipulation

Workflow

Step 1: Map Authentication Endpoints

Intercept mobile app traffic to identify authentication-related endpoints:

POST /api/v1/auth/login          - Initial authentication
POST /api/v1/auth/register       - Account registration
POST /api/v1/auth/refresh        - Token refresh
POST /api/v1/auth/logout         - Session termination
POST /api/v1/auth/forgot…