Issue Details
Insecure Authorization
mobile06 • Rank #6 in OWASP 2024
Explanation
Mobile apps may perform authorization checks client-side that can be bypassed through reverse engineering or tampering. Insecure authorization allows users to access other users' data, perform privileged actions, or bypass business logic constraints. Server-side enforcement is essential.
Remedy
Enforce authorization checks on both client and server side. Never trust client-side authorization alone. Implement proper role-based access control and validate permissions for every sensitive operation. Use server-side session management with proper token validation.
| Year | Rank | Category |
|---|---|---|
| 2016 | #6 | mobile06 - Insecure Authorization |
| 2024 | #6 | mobile06 - Insecure Authorization and Access Control |