Otukan makes a stolen session token hard to reuse and easy for your server to spot. It protects the session your app carries over TLS from sign-in to expiry: it stores session secrets in platform key storage, binds each session to the app instance and device that created it, checks the channel before a token is sent and re-evaluates risk while the session runs. Your backend receives the signals and decides whether to continue, step up or end the session. Encryption strength and certificate trust are handled by separate transport controls on Android and iOS.
This control sits inside network protection.
Trust boundary
A session crosses three boundaries, and each one needs its own check.
| Boundary | What an attacker wants | Otukan’s part | Your backend’s part |
|---|---|---|---|
| In transit | Read or reuse the token as it travels | Checks the channel is verified before the token is sent | Accepts tokens only over validated connections |
| On the device | Copy the token from storage or memory | Platform key storage, hooking and modified-device checks | Treats risk signals as input to the session decision |
| At the server | Present a copied token from elsewhere | Adds device-bound proof to sensitive requests | Verifies the proof and refuses mismatches |
Hostile intermediaries
An interception proxy on a public network, or an extra certificate authority installed on the device, lets an attacker read tokens the moment they are sent. Otukan’s channel check keeps session material off a connection that an unapproved party is inspecting. Key pinning for your most sensitive domains adds a second line; see mobile app certificate pinning.
App and backend identity
Binding turns a stolen token into one your server can recognise and refuse. The proof Otukan attaches comes from the app instance on that device, so the same token presented by a script or another phone fails at your server rather than inside the app.
Lifecycle
Sessions often outlast the conditions they started in. Plan for the changes that happen mid-session.
Certificate changes
Renewing a server certificate does not end valid sessions. Binding relies on the app instance and device, not on a particular server certificate, so a routine renewal passes and users stay signed in.
Network transitions
A user starts a payment on office Wi-Fi and finishes on mobile data. Otukan re-validates the new channel before sensitive calls resume, rather than trusting a check made on the previous network.
Long-lived sessions
Many apps keep users signed in for weeks with a refresh token. That token is the most valuable item on the device, so Otukan keeps it in device-only key storage on each platform and requires device-bound proof whenever it is exchanged for a new session.
Approved enterprise proxies
Some organisations inspect all traffic through a proxy with its own root certificate. For their users, your team declares which domains may pass through inspection and which require re-authentication on a direct connection. The choice is written down and tested before enforcement.
Availability
Aggressive session rules that lock out real users create support load and push people to weaker channels. Otukan agrees recovery before switching enforcement on.
Failure handling
When a check fails, the app does not send the token and tells the user what to do next: switch networks, update the app or sign in again. Screens that need no session keep working.
Fallback
The only fallback is fresh authentication over a verified connection. A session is not downgraded to a weaker form of proof to keep it alive.
Sign-out and revocation
When your backend ends a session, whether after a risk signal or at the user’s request, the app removes the matching session material from key storage as well. A token revoked on the server is not left waiting on the device.
Recovery
Session events are grouped by account, platform and network type, so your team can tell a theft pattern from a misconfigured proxy. Before enforcement, Otukan helps you replay a copied token from a second device in an authorised lab, confirm the same journey passes on a legitimate device, and repeat install, update, sign-in and your most sensitive flow, recording versions, devices and the reviewer.
The risk signals that travel with each session are covered on session risk signals.