CyberCertPrepWeb App FundamentalsCookies & SessionsEASYFree question
A developer wants to use cookies for authentication in a mobile app (not a browser). What is the standard approach for mobile API authentication instead?
- A.Mobile apps use the same Set-Cookie mechanism as browsers
- B.Mobile apps should use Basic auth for simplicity
- C.Mobile apps typically use bearer tokens (JWT or opaque tokens) in the Authorization header rather than cookies, because mobile HTTP clients do not automatically manage cookies like browsers and the token must be explicitly attached to each request
- D.Cookies work identically on mobile apps with no differences
Why C is correct
Browser cookie management (automatic sending, HttpOnly protection, SameSite enforcement) is a browser feature. Mobile HTTP clients (OkHttp, URLSession, Retrofit) do not automatically manage cookies the same way. The standard pattern for mobile APIs is to use OAuth 2.0 with tokens stored in platform secure storage (Android Keystore, iOS Keychain) and sent as Bearer tokens in the Authorization header.
Know someone studying for Web App Fundamentals? Send them this one.