nerdexam
CompTIA

CAS-001 · Question #502

An organization has just released a new mobile application for its customers. The application has an inbuilt browser and native application to render content from existing websites and the…

The correct answer is C. Local storage of the authenticated token on the mobile application is secured. For SSO to be secure on a mobile application, the authenticated session token stored locally must be protected, because compromise of that token allows full session hijacking across all federated services.

Technical Integration of Enterprise Components

Question

An organization has just released a new mobile application for its customers. The application has an inbuilt browser and native application to render content from existing websites and the organization's new web services gateway. All rendering of the content is performed on the mobile application. The application requires SSO between the application, the web services gateway and legacy UI. Which of the following controls MUST be implemented to securely enable SSO?

Options

  • AA registration process is implemented to have a random number stored on the client.
  • BThe identity is passed between the applications as a HTTP header over REST.
  • CLocal storage of the authenticated token on the mobile application is secured.
  • DAttestation of the XACML payload to ensure that the client is authorized.

How the community answered

(16 responses)
  • A
    13% (2)
  • C
    81% (13)
  • D
    6% (1)

Why each option

For SSO to be secure on a mobile application, the authenticated session token stored locally must be protected, because compromise of that token allows full session hijacking across all federated services.

AA registration process is implemented to have a random number stored on the client.

Storing a random number on the client is a nonce or anti-replay mechanism, not a control that secures the SSO token itself or prevents session theft.

BThe identity is passed between the applications as a HTTP header over REST.

Passing identity as a plain HTTP header over REST is inherently insecure because headers are easily intercepted or spoofed, and this approach lacks integrity protection for the identity assertion.

CLocal storage of the authenticated token on the mobile application is secured.Correct

SSO relies on a shared authentication token that grants access to multiple systems. On a mobile device, this token is stored locally, and if that storage is not secured (e.g., via encryption or secure enclave), an attacker with device access can steal the token and impersonate the user across the web services gateway and legacy UI. Securing local token storage is the foundational control that makes the entire SSO chain trustworthy.

DAttestation of the XACML payload to ensure that the client is authorized.

XACML (eXtensible Access Control Markup Language) is an authorization policy standard, not an authentication mechanism, and attestation of an XACML payload does not establish or protect the SSO session.

Concept tested: Secure token storage for mobile SSO

Source: https://owasp.org/www-project-mobile-top-10/

Topics

#SSO token storage#mobile security#OAuth/token security#REST API authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-001 Practice