Investigate App Attest / Play Integrity for headless auth #8
Description
Headless auth endpoints accept passwords directly. CORS restricts browser access, but native apps bypass CORS entirely. Currently any app can call these endpoints—we can't distinguish our genuine Divine app from a malicious clone.
App Attest (iOS) and Play Integrity (Android) let us verify requests come from legitimate app installations before accepting credentials.
This spans both backend and mobile:
- Backend: Verify attestation tokens with Apple/Google, store key IDs, check assertions on login/register
- Mobile: Generate attestations via platform APIs and include in requests
References:
- draft-ietf-oauth-first-party-apps §5.2 recommends attestation
- Apple App Attest
- Play Integrity