ASVS V2: Authentication
Requirements for how an application verifies identity — credential handling, multi-factor authentication, and session initiation.
Why It Matters
Authentication is the gate every other control sits behind. A weak implementation — no MFA option, a bypassable check, a predictable reset flow — undermines authorization and data-protection controls that assume the user is who they claim to be.
Application to Application Security
In a mobile context, ASVS V2 covers how login credentials are transmitted and stored client-side, whether OAuth flows implement PKCE, and whether biometric authentication is backed by a real hardware-secured credential rather than a UI-only check.
Relation to Software Development
Authentication logic is usually written once, early, and rarely revisited — meaning gaps introduced at initial implementation (an empty TrustManager, a missing PKCE step) can persist for years without a dedicated re-audit.
How Strata Surfaces This
Detection of disabled SSL/TLS certificate validation, insecure token storage locations, OAuth flow analysis for missing PKCE, and hardcoded bypass conditions found via bytecode decompilation.
Developer guidance
Never implement a custom TrustManager or certificate validator without a clear reason, always implement PKCE for OAuth authorization-code flows on mobile, and store tokens in platform-provided secure storage only.
Management guidance
Authentication logic warrants a dedicated review whenever it changes, not just a general code review — treat it as a higher-scrutiny code path.