.NET MAUI

Topics in this category

Advanced & Enterprise Advanced Data Binding & Collections App Lifecycle & Windows Best Practices & Architecture Concurrency & Threading Controls & Views Data Binding & MVVM Dependency Injection & Services Desktop - WinUI & Mac Catalyst Device Features & Essentials Fonts, Icons & Media Forms, Input & Validation Fundamentals & Architecture Gestures & Animations Graphics & Drawing Local Storage & Data Maps & Location Migration from Xamarin.Forms Native Interop & Libraries Networking & APIs

.NET MAUI

Security & Authentication

Q: How do you store authentication tokens securely in MAUI?

Use SecureStorage, which encrypts values with the platform keystore/keychain, for tokens and secrets. Never keep them in Preferences (plain) or in source. Clear tokens on logout with SecureStorage.Default.Remove or RemoveAll.

Q: How do you implement OAuth/OpenID Connect login in MAUI?

Use WebAuthenticator.Default.AuthenticateAsync to launch a secure system browser for the provider's authorize URL and capture the redirect callback, then exchange the code for tokens. Register a custom URL scheme/callback per platform. Libraries like IdentityModel.OidcClient can handle PKCE and token exchange.

Q: How do you add biometric authentication (fingerprint/Face ID)?

There is no built-in MAUI API, so use a plugin (e.g., Plugin.Fingerprint) or implement per platform behind an interface using BiometricPrompt (Android) and LAContext/LocalAuthentication (iOS). Always provide a fallback (PIN/password) and declare the required usage strings in Info.plist.

Q: How do you enforce SSL/certificate pinning in MAUI?

Validate the server certificate in the HttpClient handler by comparing its public key/thumbprint to a pinned value, rejecting mismatches. Configure via HttpClientHandler.ServerCertificateCustomValidationCallback (or platform handlers). Pinning defends against MITM but requires a rotation plan when certs change.

Q: What are key security best practices for a production MAUI app?

Store secrets in SecureStorage, never in code or Preferences; use HTTPS everywhere (optionally pinning); enable trimming/obfuscation to raise the bar on reverse engineering; validate all input; keep tokens short-lived with refresh; request minimal permissions; and encrypt sensitive local data (SQLCipher). Assume the client is untrusted—enforce authorization on the server.

Q: How do you protect API keys and secrets that the app needs?

Avoid shipping high-value secrets in the app at all—proxy calls through your backend so the key never reaches the device. If a key must be present (e.g., a public client id), scope it minimally and restrict it by platform/app signature at the provider. Obfuscation and SecureStorage help but don't make an embedded secret truly safe.

6 question(s)

How do you store authentication tokens securely in MAUI?

Beginner

Use SecureStorage, which encrypts values with the platform keystore/keychain, for tokens and secrets. Never keep them in Preferences (plain) or in source. Clear tokens on logout with SecureStorage.Default.Remove or RemoveAll.

await SecureStorage.Default.SetAsync("refresh_token", token);
SecureStorage.Default.Remove("refresh_token");   // on logout

Real-world example After sign-in the refresh token lives in the OS keychain and is wiped on logout.

Common follow-ups: Why not Preferences for tokens? | How do you clear on logout?

SecureStorage Authentication Security & Authentication

How do you implement OAuth/OpenID Connect login in MAUI?

Intermediate

Use WebAuthenticator.Default.AuthenticateAsync to launch a secure system browser for the provider's authorize URL and capture the redirect callback, then exchange the code for tokens. Register a custom URL scheme/callback per platform. Libraries like IdentityModel.OidcClient can handle PKCE and token exchange.

var result = await WebAuthenticator.Default.AuthenticateAsync(
    new Uri("https://idp/authorize?..."),
    new Uri("myapp://callback"));
var token = result.AccessToken;

Real-world example Users sign in with their corporate identity provider through the system browser and return to the app with tokens.

Common follow-ups: What is PKCE? | Why use the system browser over an embedded webview?

Authentication WebAuthenticator Security & Authentication

How do you add biometric authentication (fingerprint/Face ID)?

Intermediate

There is no built-in MAUI API, so use a plugin (e.g., Plugin.Fingerprint) or implement per platform behind an interface using BiometricPrompt (Android) and LAContext/LocalAuthentication (iOS). Always provide a fallback (PIN/password) and declare the required usage strings in Info.plist.

if (await CrossFingerprint.Current.IsAvailableAsync())
{
    var r = await CrossFingerprint.Current.AuthenticateAsync(
        new AuthenticationRequestConfiguration("Unlock", "Confirm it's you"));
}

Real-world example A banking app gates access with Face ID and falls back to a PIN when biometrics aren't enrolled.

Common follow-ups: What's the Info.plist requirement? | Why provide a fallback?

Authentication Platform Integration Security & Authentication

How do you enforce SSL/certificate pinning in MAUI?

Intermediate

Validate the server certificate in the HttpClient handler by comparing its public key/thumbprint to a pinned value, rejecting mismatches. Configure via HttpClientHandler.ServerCertificateCustomValidationCallback (or platform handlers). Pinning defends against MITM but requires a rotation plan when certs change.

var handler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (m, cert, chain, e) =>
        cert!.GetCertHashString() == PinnedThumbprint
};

Real-world example A finance app pins its API certificate so a compromised network CA can't intercept traffic.

Common follow-ups: What's the downside of pinning? | Where do you plan for cert rotation?

Security Networking & APIs Security & Authentication

What are key security best practices for a production MAUI app?

Advanced

Store secrets in SecureStorage, never in code or Preferences; use HTTPS everywhere (optionally pinning); enable trimming/obfuscation to raise the bar on reverse engineering; validate all input; keep tokens short-lived with refresh; request minimal permissions; and encrypt sensitive local data (SQLCipher). Assume the client is untrusted—enforce authorization on the server.

// Enforce transport security and minimal token lifetime server-side;
// client stores only short-lived tokens in SecureStorage.

Real-world example A security review confirms no secrets ship in the binary and that the server, not the app, enforces authorization.

Common follow-ups: Why treat the client as untrusted? | How does trimming help security?

Security Deployment Security & Authentication

How do you protect API keys and secrets that the app needs?

Advanced

Avoid shipping high-value secrets in the app at all—proxy calls through your backend so the key never reaches the device. If a key must be present (e.g., a public client id), scope it minimally and restrict it by platform/app signature at the provider. Obfuscation and SecureStorage help but don't make an embedded secret truly safe.

// Preferred: app -> your backend (holds the secret) -> third-party API
var data = await _myApi.GetProxiedAsync();   // no third-party key on device

Real-world example Instead of embedding a payments provider secret, the app calls its own backend which holds the key server-side.

Common follow-ups: Why can't embedded secrets be fully secured? | How do you restrict a public key?

Security Networking & APIs Security & Authentication