An organization has just released a new mobile application for its customers. The application has an inbuilt browser and native application to render content from existing websites and the…

Question

Options

• AA registration process is implemented to have a random number stored on the client.
• BThe identity is passed between the applications as a HTTP header over REST.
• CLocal storage of the authenticated token on the mobile application is secured.
• DAttestation of the XACML payload to ensure that the client is authorized.

• A
  8% (2)
• B
  4% (1)
• C
  75% (18)
• D
  13% (3)

Explanation

For SSO to function across the mobile application, the web services gateway, and the legacy UI, an authentication token (e.g., OAuth token, SAML assertion, or session cookie) must be stored locally on the mobile device so it can be silently presented to each service without re-authenticating. If this local token storage is not properly secured (e.g., stored in plaintext, accessible to other apps, or unencrypted), an attacker who gains access to the device can steal the token and impersonate the user across all three systems. Securing local token storage is therefore a mandatory control for safe SSO on mobile. Option A (random number for registration) is not sufficient by itself. Option B (HTTP header over REST) is a transport mechanism, not a security control. Option D (XACML attestation) addresses authorization policy enforcement, not SSO token security.

No community discussion yet for this question.