Securing a Mobile Financial API in Layers
Why authentication is only one part of protecting mobile payment traffic. A valid access token proves that a credential was accepted. It does not prove that the request is fresh, came from the expected application, originated from a trusted device, or has not been automated at an abusive rate. Mobile financial APIs need defense in depth. Each layer answers a different security question, and no…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.