Mobile App Security Best Practices for 2026: Complete Developer Guide

#6a9955]">// Flutter secure token storage
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

class SecureTokenStorage {
  final _storage = const FlutterSecureStorage(
    aOptions: AndroidOptions(
      encryptedSharedPreferences: true,
    ),
    iOptions: IOSOptions(
      accessibility: KeychainAccessibility.first_unlock,
    ),
  );
  
  Future<void> saveToken(String token) async {
    await _storage.write(key: &#039;auth_token&#039;, value: token);
  }
  
  Future<String?> getToken() async {
    return await _storage.read(key: &#039;auth_token&#039;);
  }
  
  Future<void> deleteToken() async {
    await _storage.delete(key: &#039;auth_token&#039;);
  }
}

#6a9955]">// Biometric authentication with fallback
import 'package:local_auth/local_auth.dart';

class BiometricAuth {
  final LocalAuthentication _auth = LocalAuthentication();
  
  Future<bool> authenticate() async {
    try {
      final canAuth = await _auth.canCheckBiometrics;
      if (!canAuth) return false;
      
      return await _auth.authenticate(
        localizedReason: &#039;Authenticate to access your account&#039;,
        options: const AuthenticationOptions(
          stickyAuth: true,
          biometricOnly: false, #6a9955]">// Allow PIN/pattern fallback
        ),
      );
    } catch (e) {
      return false;
    }
  }
}

#6a9955]">// Store sensitive data in Keychain
import Security

func saveToKeychain(key: String, data: Data) -> Bool {
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrAccount as String: key,
        kSecValueData as String: data,
        kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock
    ]
    
    SecItemDelete(query as CFDictionary)
    return SecItemAdd(query as CFDictionary, nil) == errSecSuccess
}

#6a9955]">// Store sensitive data in Android Keystore
class SecureStorage(context: Context) {
    private val masterKey = MasterKey.Builder(context)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
        .build()
    
    private val sharedPrefs = EncryptedSharedPreferences.create(
        context,
        "secure_prefs",
        masterKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
    )
    
    fun saveSecure(key: String, value: String) {
        sharedPrefs.edit().putString(key, value).apply()
    }
}

#6a9955]">// Flutter certificate pinning with Dio
import 'package:dio/dio.dart';
import 'dart:io';

class SecureApiClient {
  final Dio _dio;
  
  SecureApiClient() : _dio = Dio() {
    (_dio.httpClientAdapter as IOHttpClientAdapter).createHttpClient = () {
      final client = HttpClient();
      client.badCertificateCallback = (cert, host, port) {
        #6a9955]">// Validate against pinned certificate
        final pinnedCert = loadPinnedCertificate();
        return cert.pem == pinnedCert;
      };
      return client;
    };
  }
}

#6a9955]">// Validate all user input
class InputValidator {
  static bool isValidEmail(String email) {
    final regex = RegExp(r'^[\w-\.]+@([\w-]+\.)+[\w-]{2,4}$');
    return regex.hasMatch(email);
  }
  
  static String sanitizeInput(String input) {
    #6a9955]">// Remove potential script injections
    return input
        .replaceAll(&#039;<&#039;, &#039;&lt;&#039;)
        .replaceAll(&#039;>&#039;, &#039;&gt;&#039;)
        .replaceAll(&#039;"&#039;, &#039;&quot;&#039;)
        .replaceAll("&#039;", &#039;&#x27;&#039;);
  }
  
  static bool isValidPhoneNumber(String phone) {
    final regex = RegExp(r&#039;^\+?[1-9]\d{1,14}$&#039;);
    return regex.hasMatch(phone);
  }
}

#6a9955]">// Secure API request pattern
class SecureApi {
  Future<Response> secureRequest(
    String endpoint,
    Map<String, dynamic> data,
  ) async {
    #6a9955]">// 1. Get fresh token
    final token = await _tokenManager.getFreshToken();
    
    #6a9955]">// 2. Add request timestamp and nonce
    final timestamp = DateTime.now().toIso8601String();
    final nonce = _generateNonce();
    
    #6a9955]">// 3. Sign the request
    final signature = _signRequest(endpoint, data, timestamp, nonce);
    
    #6a9955]">// 4. Make request with security headers
    return await _dio.post(
      endpoint,
      data: data,
      options: Options(
        headers: {
          &#039;Authorization&#039;: &#039;Bearer $token&#039;,
          &#039;X-Timestamp&#039;: timestamp,
          &#039;X-Nonce&#039;: nonce,
          &#039;X-Signature&#039;: signature,
        },
      ),
    );
  }
}