Interactive explainer / iOS & Android security
A trusted device isn't an authorized user.
Follow a synthetic request from an attacker-controlled app to an API and protected resource. Change the scenario to test forged integrity evidence, mismatched app identity, replay, stale challenges, authentication failures and object authorization. Every stop explains who owns the decision.
Synthetic platform evidence is valid; the session and requested object are separately authorized.
Synthetic decision trace
Trust-boundary walkthrough
Scenario allowed
iOS: App Attest uses attested app-instance keys and assertions. This diagram does not produce or verify them.
Verifier trust boundary / Trusted server verifier
Validate platform evidence
Validate genuine proof, platform-signed evidence, app identity and verifier availability.
This is a deterministic teaching model with synthetic decisions. It makes no network requests, does not verify cryptographic signatures, and cannot issue a real access decision. A production backend requires vendor-specific validation, replay-store atomicity, authentication, object-level authorization, telemetry and recovery policy.
Verify the real platform contracts
This cross-platform diagram is an abstraction. Apple App Attest validates attested keys and request assertions, including counter and challenge handling. Play Integrity has different standard and classic request paths, with different replay safeguards. Neither provides application user authorization by itself.