{
  "id": 876501,
  "title": "App Shield: Your Server Should Not Trust the App Calling It",
  "url": "https://urgent.news/2026/08/14/app-shield-your-server-should-not-trust-the-app-calling-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-14T14:11:17.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/codenameone/app-shield-your-server-should-not-trust-the-app-calling-it-4cpa"
  },
  "original_language": "en",
  "account": "App Shield is an enterprise application-attestation layer that moves security decisions from the app to a server. It connects device integrity, certificate pinning, and backend verification by attaching a short-lived, server-verified attestation token to protected requests. Codename One, an open-source framework for building multi-platform apps, introduced App Shield to enhance security. The framework uses Apple App Attest or Google Play Integrity to obtain a hardware-backed statement, which is then verified through the Codename One service. This token is then provided to the app, allowing the backend to verify it before performing sensitive operations. App Shield's enterprise opt-in integrates with a server-verified attestation token, ensuring that even if an app is modified to return false for a local security check, it still cannot mint a valid token signed by the server's key. The app-side setup involves enabling the injected engine, registering hosts to receive a token, and configuring the network guard. The backend remains the enforcement point, receiving the app's reports of device integrity and making decisions based on that information.",
  "summary": "Any security check that runs only on a phone can be patched out on that phone. App Shield moves the final decision to your server by attaching a short-lived, server-verified attestation token to protected requests. What is Codename One? Codename One is an open-source framework for building native iOS, Android, desktop, and web apps from a single Java or Kotlin codebase. Learn more at…",
  "key_points": [
    "App Shield moves security decisions from app to server",
    "Uses Apple App Attest or Google Play Integrity for hardware-backed statement",
    "Backend verifies token before performing sensitive operations"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}