Transport Security and Authentication

Transport security and authorization answer different questions. Transport security helps the app communicate with the intended service. Authentication establishes identity, while authorization decides whether that identity may perform an action.

The design must handle more than successful sign-in. It also needs credential renewal, account switching, and recovery from uncertain results.

Validate the connection normally

Use HTTPS with certificate-chain and hostname validation. Do not accept every certificate, ignore validation failures, or retry over plaintext after a TLS error.