Skip to content

Bonus Security Feature Ideas

Overview

Implement one or more of the following security features in your full-stack project to earn +1 extra point for the written exam. The point is awarded only together with the +2 early completion bonus.

A feature counts when it is working, demonstrated, and explained: show the attack it prevents, then show the app resisting it. A feature that only exists in code with no demo does not count.

Note: You are welcome to propose your own feature idea, but please confirm it with the seminar instructor first!

Ideas Based on Lecture Topics

Authentication & Identity

  • Multi-factor authentication: a TOTP second factor (authenticator app) or a server-sent one-time code, with recovery codes shown once and stored hashed.
  • Passkeys / WebAuthn login instead of, or in addition to, passwords, using the platform authenticator.
  • Short-lived access tokens with refresh rotation: refresh tokens are single-use, reuse is detected and revokes the whole session family.
  • Session management screen: list active devices, show last activity, and revoke any session from the app.
  • Brute-force protection on the server: rate limiting per account and per IP, progressive delays, lockout with a friendly explanation in the app.

Secure Storage & Cryptography

  • Encrypted local database (e.g. SQLCipher or an encrypted Room/Core Data layer) with the key held in the Keystore/Keychain, never in code or preferences.
  • End-to-end encrypted field: one entity field (notes, attachments) is encrypted on the device with a user-derived key, so the server stores only ciphertext.
  • Key rotation: re-encrypt local data with a new key on password change, with a visible progress state and a safe fallback if interrupted.
  • Secure backup export: an encrypted, integrity-checked export/import of the user's data with a passphrase, using an authenticated cipher (AES-GCM or ChaCha20-Poly1305).

Network Security

  • Certificate pinning with a pin-rotation strategy (backup pin) and a clear error state when pinning fails, demonstrated with an intercepting proxy.
  • Request signing or replay protection: requests carry a nonce and timestamp validated by the server, so a captured request cannot be replayed.
  • Offline queue with conflict detection that is tamper-aware: queued changes are signed on the device and rejected by the server if modified.
  • Server-side input validation and output encoding demonstrated against injection and mass-assignment attempts, with structured error responses.

App Hardening

  • Root/jailbreak and emulator detection with a degraded mode (read-only, no sensitive screens) rather than a hard exit.
  • Screen protection: block screenshots and screen recording on sensitive screens, and hide content in the app switcher.
  • Tamper and integrity checks: verify the app signature or use Play Integrity / App Attest before talking to the server, and show what happens when the check fails.
  • Secure logging: a logging layer that redacts tokens, personal data and secrets, verified by inspecting the device logs during the demo.
  • Secrets hygiene: no API keys in the binary, demonstrated by decompiling your own release build and showing nothing sensitive is recoverable.

Privacy

  • Data minimisation and retention: a privacy screen that shows what is stored, lets the user delete their account and data, and proves the server actually erases it.
  • Runtime permission rationale: request sensitive permissions only when needed, explain why, and keep the feature usable when denied.
  • Privacy-preserving analytics: event counts without identifiers, or on-device aggregation before anything leaves the phone.
  • Role-based data separation audit: an admin-only report that shows which role can see which records, verified by logging in as each role.

IoT & Devices

  • Secure device pairing: pair the app with a simulated or real IoT device over BLE or local network using an out-of-band code, not an open connection.
  • Mutual TLS or per-device keys between the device and the server, with revocation of a lost device from the app.
  • Firmware / configuration update verification: the app refuses to push an update whose signature does not verify.

Security Testing

  • Automated security tests in the repository: tests for authorization on every endpoint (each role tries each operation) and for token expiry handling.
  • Static analysis in CI: run MobSF or a similar scanner in GitHub Actions and fix or justify every high finding.
  • Threat model document in the README: assets, attackers, entry points, and the mitigation each of your features provides, kept in sync with the code.
  • Penetration test report of your own app: what you tried with a proxy and a rooted device, what you found, what you fixed.