Mobile App Security: Essential Practices for Developers in 2025

In today's hyper-connected world, mobile applications handle increasingly sensitive data and complex transactions. As we navigate through 2025, securing mobile applications has become more critical than ever. This comprehensive guide explores current best practices, emerging threats, and practical solutions for developers building secure mobile applications.

Table of Contents

1. Current Mobile Security Landscape
2. Essential Security Practices
3. Platform-Specific Security Considerations
4. API Security and Network Communication
5. Data Storage and Encryption
6. Authentication and Authorization
7. Code Security and Prevention of Common Vulnerabilities
8. Security Testing and Monitoring
9. Emerging Threats and Mitigations
10. Compliance and Regulations

Current Mobile Security Landscape

Key Statistics and Trends

• 78% of mobile breaches in 2025 involve sophisticated malware targeting application vulnerabilities
• Runtime application self-protection (RASP) adoption has increased by 156% since 2023
• Zero-trust architecture implementation in mobile apps has become standard practice
• AI-powered security threats have evolved to target mobile applications specifically

Notable Security Incidents

The recent breach of PopularApp (name changed) exposed 50 million user records due to improper API security implementation, highlighting the importance of robust security measures.

Essential Security Practices

1. Secure Token Management

React Native Example

// Bad Practice - NEVER store passwords on the client
const userCredentials = {
  username: 'user',
  password: 'pass123'  // Hard-coded credentials - NEVER DO THIS
};

// Good Practice - Store only tokens, never passwords
import EncryptedStorage from 'react-native-encrypted-storage';

async function storeAuthToken(token, refreshToken) {
  try {
    await EncryptedStorage.setItem(
      'auth_tokens',
      JSON.stringify({
        accessToken: token,
        refreshToken: refreshToken,
        timestamp: Date.now()
      })
    );
  } catch (error) {
    console.error('Storage error:', error);
  }
}

// Always validate tokens before use
async function getValidToken() {
  try {
    const storedTokens = await EncryptedStorage.getItem('auth_tokens');
    if (!storedTokens) return null;
    
    const tokens = JSON.parse(storedTokens);
    const tokenAge = Date.now() - tokens.timestamp;
    const TOKEN_EXPIRY = 3600000; // 1 hour
    
    if (tokenAge > TOKEN_EXPIRY) {
      // Refresh token logic here
      return await refreshAuthToken(tokens.refreshToken);
    }
    
    return tokens.accessToken;
  } catch (error) {
    console.error('Token retrieval error:', error);
    return null;
  }
}

Swift Example

// Bad Practice
class UserData {
    static let shared = UserData()
    var apiKey = "1234567890"  // Hard-coded API key - NEVER DO THIS
}

// Good Practice - Use Keychain for secure token storage
import Security

class SecureTokenManager {
    static let shared = SecureTokenManager()
    private let service = "com.yourapp.tokens"
    
    func storeToken(_ token: String, for key: String) throws {
        let data = token.data(using: .utf8)!
        
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecValueData as String: data,
            kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
        ]
        
        SecItemDelete(query as CFDictionary)
        let status = SecItemAdd(query as CFDictionary, nil)
        
        guard status == errSecSuccess else {
            throw TokenError.storageError
        }
    }
    
    func getToken(for key: String) throws -> String? {
        let query: [String: Any] = [
            kSecClass as String: kSecClassGenericPassword,
            kSecAttrService as String: service,
            kSecAttrAccount as String: key,
            kSecReturnData as String: true,
            kSecMatchLimit as String: kSecMatchLimitOne
        ]
        
        var result: AnyObject?
        let status = SecItemCopyMatching(query as CFDictionary, &result)
        
        guard status == errSecSuccess,
              let data = result as? Data,
              let token = String(data: data, encoding: .utf8) else {
            return nil
        }
        
        return token
    }
}

enum TokenError: Error {
    case storageError
    case retrievalError
}

2. Secure Data Storage

Flutter Example

// Implementing secure storage for tokens only
import 'package:flutter_secure_storage/flutter_secure_storage.dart';
import 'dart:convert';

class SecureStorageService {
  static const _storage = FlutterSecureStorage(
    aOptions: AndroidOptions(
      encryptedSharedPreferences: true,
    ),
    iOptions: IOSOptions(
      accessibility: KeychainAccessibility.first_unlock_this_device,
    ),
  );
  
  // Store authentication tokens securely
  static Future<void> storeAuthTokens({
    required String accessToken,
    required String refreshToken,
  }) async {
    final tokenData = {
      'access_token': accessToken,
      'refresh_token': refreshToken,
      'stored_at': DateTime.now().millisecondsSinceEpoch,
    };
    
    await _storage.write(
      key: 'auth_tokens',
      value: jsonEncode(tokenData),
    );
  }
  
  // Retrieve and validate tokens
  static Future<Map<String, String>?> getValidAuthTokens() async {
    try {
      final tokenJson = await _storage.read(key: 'auth_tokens');
      if (tokenJson == null) return null;
      
      final tokenData = jsonDecode(tokenJson) as Map<String, dynamic>;
      final storedAt = tokenData['stored_at'] as int;
      final now = DateTime.now().millisecondsSinceEpoch;
      
      // Check if token is older than 1 hour
      if (now - storedAt > 3600000) {
        await clearAuthTokens();
        return null;
      }
      
      return {
        'access_token': tokenData['access_token'] as String,
        'refresh_token': tokenData['refresh_token'] as String,
      };
    } catch (e) {
      await clearAuthTokens();
      return null;
    }
  }
  
  static Future<void> clearAuthTokens() async {
    await _storage.delete(key: 'auth_tokens');
  }
}

Platform-Specific Security Considerations

Android Security

Kotlin Example

import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import java.security.KeyStore
import javax.crypto.KeyGenerator

class CryptographyManager {
    private val keyStore = KeyStore.getInstance("AndroidKeyStore").apply {
        load(null)
    }
    
    private val keyAlias = "SECRET_KEY"
    
    fun generateSecretKey() {
        val keyGenerator = KeyGenerator.getInstance(
            KeyProperties.KEY_ALGORITHM_AES,
            "AndroidKeyStore"
        )
        
        val keyGenParameterSpec = KeyGenParameterSpec.Builder(
            keyAlias,
            KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
        )
            .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
            .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
            .setUserAuthenticationRequired(true)
            .setUserAuthenticationTimeout(120) // 2 minutes
            .setInvalidatedByBiometricEnrollment(true)
            .build()
            
        keyGenerator.init(keyGenParameterSpec)
        keyGenerator.generateKey()
    }
    
    fun isKeyExists(): Boolean {
        return try {
            keyStore.containsAlias(keyAlias)
        } catch (e: Exception) {
            false
        }
    }
}

iOS Security

Swift Example for Biometric Authentication

import LocalAuthentication
import CryptoKit

class BiometricAuthManager {
    private let context = LAContext()
    
    func authenticateUser() async -> Result<Bool, AuthError> {
        var error: NSError?
        
        guard context.canEvaluatePolicy(
            .deviceOwnerAuthenticationWithBiometrics,
            error: &error
        ) else {
            return .failure(.biometricNotAvailable)
        }
        
        do {
            let success = try await context.evaluatePolicy(
                .deviceOwnerAuthenticationWithBiometrics,
                localizedReason: "Authenticate to access secure data"
            )
            return .success(success)
        } catch {
            return .failure(.authenticationFailed)
        }
    }
    
    func authenticateWithFallback() async -> Result<Bool, AuthError> {
        do {
            let success = try await context.evaluatePolicy(
                .deviceOwnerAuthentication,
                localizedReason: "Authenticate to access your account"
            )
            return .success(success)
        } catch {
            return .failure(.authenticationFailed)
        }
    }
}

enum AuthError: Error, LocalizedError {
    case biometricNotAvailable
    case authenticationFailed
    
    var errorDescription: String? {
        switch self {
        case .biometricNotAvailable:
            return "Biometric authentication is not available"
        case .authenticationFailed:
            return "Authentication failed"
        }
    }
}

API Security and Network Communication

Implementing Certificate Pinning

React Native Example

import axios from 'axios';
import { Platform } from 'react-native';

class ApiClient {
  constructor() {
    this.client = axios.create({
      baseURL: 'https://api.example.com',
      timeout: 10000,
      headers: {
        'Content-Type': 'application/json',
        'Accept': 'application/json',
      }
    });
    
    this.setupInterceptors();
  }
  
  setupInterceptors() {
    // Request interceptor to add auth token
    this.client.interceptors.request.use(
      async (config) => {
        const token = await this.getValidToken();
        if (token) {
          config.headers.Authorization = `Bearer ${token}`;
        }
        return config;
      },
      (error) => Promise.reject(error)
    );
    
    // Response interceptor to handle token refresh
    this.client.interceptors.response.use(
      (response) => response,
      async (error) => {
        if (error.response?.status === 401) {
          const refreshed = await this.refreshToken();
          if (refreshed) {
            return this.client.request(error.config);
          } else {
            // Redirect to login
            this.handleLogout();
          }
        }
        return Promise.reject(error);
      }
    );
  }
  
  async getValidToken() {
    // Implementation from earlier example
    return await getValidToken();
  }
  
  async refreshToken() {
    // Implement token refresh logic
    try {
      const refreshToken = await this.getRefreshToken();
      if (!refreshToken) return false;
      
      const response = await axios.post('/auth/refresh', {
        refresh_token: refreshToken
      });
      
      const { access_token, refresh_token } = response.data;
      await storeAuthToken(access_token, refresh_token);
      return true;
    } catch (error) {
      return false;
    }
  }
}

Kotlin Example with OkHttp

import okhttp3.OkHttpClient
import okhttp3.CertificatePinner
import okhttp3.Interceptor
import okhttp3.logging.HttpLoggingInterceptor
import java.util.concurrent.TimeUnit

class SecureApiClient {
    private val certificatePinner = CertificatePinner.Builder()
        .add("api.example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
        .add("api.example.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")
        .build()
    
    private val loggingInterceptor = HttpLoggingInterceptor().apply {
        level = if (BuildConfig.DEBUG) {
            HttpLoggingInterceptor.Level.BODY
        } else {
            HttpLoggingInterceptor.Level.NONE
        }
    }
    
    private val authInterceptor = Interceptor { chain ->
        val originalRequest = chain.request()
        val token = getStoredToken()
        
        val authenticatedRequest = if (token != null) {
            originalRequest.newBuilder()
                .header("Authorization", "Bearer $token")
                .build()
        } else {
            originalRequest
        }
        
        chain.proceed(authenticatedRequest)
    }
    
    val client = OkHttpClient.Builder()
        .certificatePinner(certificatePinner)
        .addInterceptor(authInterceptor)
        .addInterceptor(loggingInterceptor)
        .connectTimeout(30, TimeUnit.SECONDS)
        .readTimeout(30, TimeUnit.SECONDS)
        .writeTimeout(30, TimeUnit.SECONDS)
        .build()
    
    private fun getStoredToken(): String? {
        // Retrieve token from secure storage
        return try {
            SecurePreferences.getString("access_token", null)
        } catch (e: Exception) {
            null
        }
    }
}

Data Storage and Encryption

Implementing AES Encryption

Flutter Example

import 'package:encrypt/encrypt.dart';
import 'dart:convert';
import 'dart:math';

class EncryptionService {
  static Key _generateKey() {
    final secureRandom = Random.secure();
    final keyBytes = List<int>.generate(32, (i) => secureRandom.nextInt(256));
    return Key(Uint8List.fromList(keyBytes));
  }
  
  static IV _generateIV() {
    final secureRandom = Random.secure();
    final ivBytes = List<int>.generate(16, (i) => secureRandom.nextInt(256));
    return IV(Uint8List.fromList(ivBytes));
  }

  static Future<String> encryptData(String data) async {
    final key = _generateKey();
    final iv = _generateIV();
    final encrypter = Encrypter(AES(key));
    
    final encrypted = encrypter.encrypt(data, iv: iv);
    
    // Store key and IV securely (in production, use proper key management)
    await SecureStorageService._storage.write(
      key: 'encryption_key',
      value: key.base64,
    );
    await SecureStorageService._storage.write(
      key: 'encryption_iv',
      value: iv.base64,
    );
    
    return encrypted.base64;
  }

  static Future<String?> decryptData(String encryptedData) async {
    try {
      final keyString = await SecureStorageService._storage.read(key: 'encryption_key');
      final ivString = await SecureStorageService._storage.read(key: 'encryption_iv');
      
      if (keyString == null || ivString == null) return null;
      
      final key = Key.fromBase64(keyString);
      final iv = IV.fromBase64(ivString);
      final encrypter = Encrypter(AES(key));
      
      final encrypted = Encrypted.fromBase64(encryptedData);
      return encrypter.decrypt(encrypted, iv: iv);
    } catch (e) {
      return null;
    }
  }
}

Authentication and Authorization

OAuth 2.0 Implementation

React Native Example

import { authorize, refresh } from 'react-native-app-auth';

const authConfig = {
  issuer: 'https://auth.example.com',
  clientId: 'YOUR_CLIENT_ID',
  redirectUrl: 'com.example.app://oauth',
  scopes: ['openid', 'profile', 'email'],
  additionalParameters: {},
  customHeaders: {
    'User-Agent': 'YourApp/1.0.0'
  }
};

class AuthService {
  static async authenticate() {
    try {
      const result = await authorize(authConfig);
      
      // Store only tokens, never passwords
      await storeAuthToken(result.accessToken, result.refreshToken);
      
      return {
        success: true,
        accessToken: result.accessToken,
        user: this.parseTokenPayload(result.idToken)
      };
    } catch (error) {
      console.error('Authentication failed:', error);
      return { success: false, error: error.message };
    }
  }
  
  static async refreshAccessToken() {
    try {
      const tokens = await getValidAuthTokens();
      if (!tokens?.refresh_token) {
        throw new Error('No refresh token available');
      }
      
      const result = await refresh(authConfig, {
        refreshToken: tokens.refresh_token
      });
      
      await storeAuthToken(result.accessToken, result.refreshToken);
      return result.accessToken;
    } catch (error) {
      console.error('Token refresh failed:', error);
      await this.logout();
      throw error;
    }
  }
  
  static parseTokenPayload(token) {
    try {
      const payload = token.split('.')[1];
      const decoded = JSON.parse(atob(payload));
      return decoded;
    } catch (error) {
      return null;
    }
  }
  
  static async logout() {
    await clearAuthTokens();
    // Additional logout logic (clear cache, redirect, etc.)
  }
}

Code Security and Prevention of Common Vulnerabilities

Input Validation

Swift Example

import Foundation

struct InputValidator {
    static func validateEmail(_ email: String) -> ValidationResult {
        let emailRegex = #"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"#
        let emailPredicate = NSPredicate(format: "SELF MATCHES %@", emailRegex)
        
        guard emailPredicate.evaluate(with: email) else {
            return .invalid("Invalid email format")
        }
        
        guard email.count <= 254 else {
            return .invalid("Email too long")
        }
        
        return .valid
    }
    
    static func sanitizeUserInput(_ input: String) -> String {
        // Remove potentially dangerous characters
        let allowedCharacters = CharacterSet.alphanumerics.union(.whitespaces).union(CharacterSet(charactersIn: "@._-"))
        let sanitized = input.components(separatedBy: allowedCharacters.inverted).joined()
        
        // Limit length
        return String(sanitized.prefix(100))
    }
    
    static func validatePhoneNumber(_ phone: String) -> ValidationResult {
        let cleanPhone = phone.components(separatedBy: CharacterSet.decimalDigits.inverted).joined()
        
        guard cleanPhone.count >= 10 && cleanPhone.count <= 15 else {
            return .invalid("Invalid phone number length")
        }
        
        return .valid
    }
}

enum ValidationResult {
    case valid
    case invalid(String)
}

Security Testing and Monitoring

Implementing Security Logging

Kotlin Example

import android.util.Log
import kotlinx.coroutines.CoroutineScope
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.launch
import java.text.SimpleDateFormat
import java.util.*

class SecurityLogger {
    companion object {
        private const val TAG = "SecurityLog"
        private val dateFormat = SimpleDateFormat("yyyy-MM-dd HH:mm:ss", Locale.getDefault())
        private val coroutineScope = CoroutineScope(Dispatchers.IO)
        
        fun logSecurityEvent(
            eventType: SecurityEventType,
            details: String,
            severity: SecuritySeverity = SecuritySeverity.MEDIUM,
            userId: String? = null
        ) {
            val timestamp = dateFormat.format(Date())
            val logEntry = SecurityLogEntry(
                timestamp = timestamp,
                eventType = eventType,
                details = sanitizeLogData(details),
                severity = severity,
                userId = userId,
                deviceInfo = getDeviceInfo()
            )
            
            // Log locally (for debugging in development)
            when (severity) {
                SecuritySeverity.HIGH -> Log.e(TAG, logEntry.toString())
                SecuritySeverity.MEDIUM -> Log.w(TAG, logEntry.toString())
                SecuritySeverity.LOW -> Log.i(TAG, logEntry.toString())
            }
            
            // Send to secure logging service (in production)
            coroutineScope.launch {
                sendToSecureLoggingService(logEntry)
            }
        }
        
        private fun sanitizeLogData(data: String): String {
            // Remove sensitive information from logs
            return data
                .replace(Regex("\\b[A-Za-z0-9+/]{20,}\\b"), "[TOKEN]") // Tokens
                .replace(Regex("\\b\\d{13,19}\\b"), "[CARD_NUMBER]") // Credit card numbers
                .replace(Regex("\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b"), "[EMAIL]") // Emails
        }
        
        private fun getDeviceInfo(): String {
            return "${Build.MANUFACTURER} ${Build.MODEL} (API ${Build.VERSION.SDK_INT})"
        }
        
        private suspend fun sendToSecureLoggingService(logEntry: SecurityLogEntry) {
            try {
                // Implementation to send logs to secure remote service
                // Only in production, with proper encryption and authentication
            } catch (e: Exception) {
                Log.e(TAG, "Failed to send log to remote service", e)
            }
        }
    }
}

data class SecurityLogEntry(
    val timestamp: String,
    val eventType: SecurityEventType,
    val details: String,
    val severity: SecuritySeverity,
    val userId: String?,
    val deviceInfo: String
)

enum class SecurityEventType {
    LOGIN_ATTEMPT,
    AUTHENTICATION_FAILURE,
    TOKEN_REFRESH,
    SUSPICIOUS_ACTIVITY,
    DATA_ACCESS,
    API_CALL_FAILED,
    CERTIFICATE_PINNING_FAILURE
}

enum class SecuritySeverity {
    LOW, MEDIUM, HIGH
}

Emerging Threats and Mitigations

Protection Against AI-Powered Attacks

React Native Example

// Implementing rate limiting and anomaly detection
class SecurityMonitor {
  constructor() {
    this.requestCounts = new Map();
    this.failureCounts = new Map();
    this.threshold = 100; // Requests per minute
    this.failureThreshold = 5; // Failed attempts per minute
    this.cleanupInterval = 60000; // 1 minute
    
    // Cleanup old entries periodically
    setInterval(() => this.cleanup(), this.cleanupInterval);
  }

  checkRequest(userId, endpoint) {
    const now = Date.now();
    const key = `${userId}-${endpoint}`;
    const userRequests = this.requestCounts.get(key) || [];
    
    // Remove old requests
    const recentRequests = userRequests.filter(
      time => now - time < this.cleanupInterval
    );
    
    if (recentRequests.length >= this.threshold) {
      this.logSecurityEvent('RATE_LIMIT_EXCEEDED', {
        userId,
        endpoint,
        requestCount: recentRequests.length
      });
      throw new SecurityError('Request limit exceeded', 'RATE_LIMIT');
    }
    
    recentRequests.push(now);
    this.requestCounts.set(key, recentRequests);
  }
  
  recordFailure(userId, failureType) {
    const now = Date.now();
    const key = `${userId}-${failureType}`;
    const failures = this.failureCounts.get(key) || [];
    
    const recentFailures = failures.filter(
      time => now - time < this.cleanupInterval
    );
    
    recentFailures.push(now);
    this.failureCounts.set(key, recentFailures);
    
    if (recentFailures.length >= this.failureThreshold) {
      this.logSecurityEvent('SUSPICIOUS_ACTIVITY', {
        userId,
        failureType,
        failureCount: recentFailures.length
      });
      
      // Implement additional security measures
      this.triggerSecurityResponse(userId);
    }
  }
  
  triggerSecurityResponse(userId) {
    // Implement security response (temporary account lock, additional verification, etc.)
    console.warn(`Security response triggered for user: ${userId}`);
  }
  
  cleanup() {
    const now = Date.now();
    
    // Clean up old request counts
    for (const [key, requests] of this.requestCounts.entries()) {
      const recentRequests = requests.filter(
        time => now - time < this.cleanupInterval
      );
      if (recentRequests.length === 0) {
        this.requestCounts.delete(key);
      } else {
        this.requestCounts.set(key, recentRequests);
      }
    }
    
    // Clean up old failure counts
    for (const [key, failures] of this.failureCounts.entries()) {
      const recentFailures = failures.filter(
        time => now - time < this.cleanupInterval
      );
      if (recentFailures.length === 0) {
        this.failureCounts.delete(key);
      } else {
        this.failureCounts.set(key, recentFailures);
      }
    }
  }
  
  logSecurityEvent(eventType, details) {
    // Send to logging service
    console.log(`Security Event: ${eventType}`, details);
  }
}

class SecurityError extends Error {
  constructor(message, code) {
    super(message);
    this.name = 'SecurityError';
    this.code = code;
  }
}

// Usage example
const securityMonitor = new SecurityMonitor();

// In API calls
async function makeSecureApiCall(userId, endpoint, data) {
  try {
    securityMonitor.checkRequest(userId, endpoint);
    
    const response = await fetch(endpoint, {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${await getValidToken()}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify(data)
    });
    
    if (!response.ok) {
      securityMonitor.recordFailure(userId, 'API_FAILURE');
      throw new Error(`API call failed: ${response.status}`);
    }
    
    return await response.json();
  } catch (error) {
    if (error instanceof SecurityError) {
      throw error;
    }
    securityMonitor.recordFailure(userId, 'API_ERROR');
    throw error;
  }
}

Compliance and Regulations

GDPR Compliance Implementation

Flutter Example

class PrivacyManager {
  static const _storage = FlutterSecureStorage();
  static const String _consentKey = 'user_consent';
  
  Future<void> handleDataDeletion(String userId) async {
    try {
      // Clear all user data from local storage
      await _clearAllUserData(userId);
      
      // Delete data from remote server
      final token = await SecureStorageService.getValidAuthTokens();
      if (token == null) throw Exception('No valid authentication token');
      
      final response = await http.delete(
        Uri.parse('https://api.example.com/users/$userId'),
        headers: {
          'Authorization': 'Bearer ${token['access_token']}',
          'Content-Type': 'application/json',
        },
      );
      
      if (response.statusCode != 200) {
        throw Exception('Failed to delete user data from server');
      }
      
      // Log deletion for compliance audit trail
      await _logComplianceEvent(
        event: 'USER_DATA_DELETION',
        userId: userId,
        timestamp: DateTime.now(),
        details: 'Complete user data deletion completed successfully',
      );
      
      // Clear authentication tokens
      await SecureStorageService.clearAuthTokens();
      
    } catch (e) {
      await _logComplianceEvent(
        event: 'USER_DATA_DELETION_FAILED',
        userId: userId,
        timestamp: DateTime.now(),
        details: 'Data deletion failed: $e',
      );
      throw ComplianceException('Failed to delete user data: $e');
    }
  }
  
  Future<void> recordConsent({
    required String userId,
    required Map<String, bool> consentTypes,
  }) async {
    final consentRecord = {
      'user_id': userId,
      'timestamp': DateTime.now().toIso8601String(),
      'consents': consentTypes,
      'version': '1.0',
    };
    
    await _storage.write(
      key: '${_consentKey}_$userId',
      value: jsonEncode(consentRecord),
    );
    
    await _logComplianceEvent(
      event: 'CONSENT_RECORDED',
      userId: userId,
      timestamp: DateTime.now(),
      details: 'User consent recorded: ${consentTypes.keys.join(', ')}',
    );
  }
  
  Future<Map<String, bool>?> getUserConsent(String userId) async {
    try {
      final consentJson = await _storage.read(key: '${_consentKey}_$userId');
      if (consentJson == null) return null;
      
      final consentData = jsonDecode(consentJson) as Map<String, dynamic>;
      return Map<String, bool>.from(consentData['consents'] as Map);
    } catch (e) {
      return null;
    }
  }
  
  Future<void> exportUserData(String userId) async {
    try {
      final token = await SecureStorageService.getValidAuthTokens();
      if (token == null) throw Exception('No valid authentication token');
      
      final response = await http.get(
        Uri.parse('https://api.example.com/users/$userId/export'),
        headers: {
          'Authorization': 'Bearer ${token['access_token']}',
          'Accept': 'application/json',
        },
      );
      
      if (response.statusCode != 200) {
        throw Exception('Failed to export user data');
      }
      
      await _logComplianceEvent(
        event: 'USER_DATA_EXPORT',
        userId: userId,
        timestamp: DateTime.now(),
        details: 'User data export completed successfully',
      );
      
      // Return or save the exported data
      return response.body;
    } catch (e) {
      await _logComplianceEvent(
        event: 'USER_DATA_EXPORT_FAILED',
        userId: userId,
        timestamp: DateTime.now(),
        details: 'Data export failed: $e',
      );
      throw ComplianceException('Failed to export user data: $e');
    }
  }
  
  Future<void> _clearAllUserData(String userId) async {
    // Clear all user-related data from secure storage
    final allKeys = await _storage.readAll();
    final userKeys = allKeys.keys.where((key) => key.contains(userId));
    
    for (final key in userKeys) {
      await _storage.delete(key: key);
    }
  }
  
  Future<void> _logComplianceEvent({
    required String event,
    required String userId,
    required DateTime timestamp,
    required String details,
  }) async {
    final logEntry = {
      'event': event,
      'user_id': userId,
      'timestamp': timestamp.toIso8601String(),
      'details': details,
      'app_version': '1.0.0', // Get from package info
    };
    
    // Store compliance log securely
    final logKey = 'compliance_log_${timestamp.millisecondsSinceEpoch}';
    await _storage.write(key: logKey, value: jsonEncode(logEntry));
    
    // In production, also send to compliance logging service
    // await _sendToComplianceService(logEntry);
  }
}

class ComplianceException implements Exception {
  final String message;
  ComplianceException(this.message);
  
  @override
  String toString() => 'ComplianceException: $message';
}

Best Practices Summary

Critical Security Rules

1. NEVER store passwords on the client side

   • Always use secure token-based authentication
   • Store only access tokens and refresh tokens
   • Implement proper token rotation and expiration

2. Use platform-specific secure storage

   • iOS: Keychain Services
   • Android: Android Keystore
   • Cross-platform: Use secure storage libraries

3. Implement proper certificate pinning

   • Pin certificates, not just domains
   • Have backup pins ready
   • Monitor for certificate changes

4. Validate all inputs

   • Sanitize user inputs
   • Use allowlists, not denylists
   • Implement proper length limits

5. Log security events properly

   • Never log sensitive data
   • Sanitize logs before storage
   • Implement secure log transmission

Token Management Best Practices

// Token management lifecycle
class TokenManager {
  static async authenticateUser(credentials) {
    // 1. Send credentials to server (over HTTPS)
    const response = await fetch('/auth/login', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(credentials) // Credentials sent to server only
    });
    
    // 2. Receive tokens from server
    const { access_token, refresh_token } = await response.json();
    
    // 3. Store tokens securely (NEVER store original password)
    await this.storeTokens(access_token, refresh_token);
    
    // 4. Clear credentials from memory
    credentials = null;
    
    return { success: true };
  }
  
  static async storeTokens(accessToken, refreshToken) {
    await EncryptedStorage.setItem('auth_tokens', JSON.stringify({
      access_token: accessToken,
      refresh_token: refreshToken,
      stored_at: Date.now()
    }));
  }
  
  static async getValidToken() {
    const tokens = await this.getStoredTokens();
    if (!tokens) return null;
    
    if (this.isTokenExpiringSoon(tokens.access_token)) {
      return await this.refreshToken(tokens.refresh_token);
    }
    
    return tokens.access_token;
  }
  
  static isTokenExpiringSoon(token) {
    try {
      const payload = JSON.parse(atob(token.split('.')[1]));
      const expirationTime = payload.exp * 1000;
      const currentTime = Date.now();
      const fiveMinutes = 5 * 60 * 1000;
      
      return (expirationTime - currentTime) < fiveMinutes;
    } catch {
      return true; // If we can't parse it, consider it expired
    }
  }
}

Security Checklist for Mobile Apps

• Authentication

  • Implement OAuth 2.0 or similar secure authentication
  • Use biometric authentication where available
  • Never store passwords on client
  • Implement proper session management

• Data Protection

  • Use platform-specific secure storage
  • Encrypt sensitive data at rest
  • Implement proper key management
  • Clear sensitive data from memory

• Network Security

  • Use HTTPS for all communications
  • Implement certificate pinning
  • Validate server certificates
  • Implement request signing

• Code Security

  • Obfuscate production code
  • Remove debug information
  • Implement anti-tampering measures
  • Use code signing

• Runtime Security

  • Implement jailbreak/root detection
  • Monitor for debugging attempts
  • Implement runtime application self-protection (RASP)
  • Log security events

• Compliance

  • Implement GDPR compliance
  • Handle data deletion requests
  • Maintain audit logs
  • Implement consent management

Conclusion

Mobile app security in 2025 requires a comprehensive approach that combines traditional security practices with protection against emerging threats. The most critical principle is to never store passwords on the client side - always use secure token-based authentication with proper token management.

Key takeaways for secure mobile development:

Authentication Security: Implement robust token-based authentication with proper rotation, never storing passwords locally. Use biometric authentication as an additional security layer.

Data Protection: Leverage platform-specific secure storage mechanisms and encrypt sensitive data. Implement proper key management and ensure sensitive data is cleared from memory.

Network Security: Use HTTPS exclusively, implement certificate pinning, and validate all server communications. Never trust client-side data validation alone.

Code Security: Obfuscate production code, remove debug information, and implement anti-tampering measures. Use proper code signing and distribution mechanisms.

Monitoring and Compliance: Implement comprehensive security logging while protecting user privacy. Maintain compliance with regulations like GDPR through proper consent management and data handling procedures.

Remember to regularly update security practices, conduct security assessments, and stay informed about emerging threats. Security is not a one-time implementation but an ongoing process that must evolve with the threat landscape.

For more information about mobile app security consulting services, contact Principal LA at [contact information].

---

This blog post was last updated on August 09, 2025. The security landscape constantly evolves, so ensure you're always using the latest security practices and tools.