Can you modify the front-end source code of a mobile app?

Question

I get that a front-end isn't secure on the web because one could theoretically access the front-end code by opening dev tools and changing the code.

Do I also need to be careful about security for a mobile app? (meaning not a web app)

Based on what I'm reading here https://www.quora.com/Can-we-get-the-source-code-of-any-mobile-app and here https://www.quora.com/Is-it-possible-to-get-source-code-for-an-iPhone-application-up-to-some-extent-If-yes-how-can-I-do-that, am I correct that you still need to pay attention to security on a mobile front-end because someone could access the .apk file of an android app and modify it or do the same to the .ipa files of an iPhone app?

Answer 1

Yes of course.

People like to think that because a lay person can't read the source code for compiled or even "transpiled" applications in the same way you can with javascript on a website that it's unalterable. But its not, you just need different tools.

Now applications can also be signed, which allows the operating system to tell if an app has been created by the developer it says it is. If you change the facebook app for example, the OS will know that its not the same app.

But this is really preventing people from publishing fake apps on the store, rather than stopping hacking.

Answer 2

It's not just that people might be able to hack into your front-end app. They might be connecting directly to your server with an app that they wrote themselves.

I can get around whatever security in iOS prevents me from modifying an iPhone app, by just using Xcode to write a Mac app that connects to your server, pretends that it is a client app, and asks your server to do things that it shouldn't do. iOS security or Android security can do nothing about it, because my code never runs on any phone.

On your server, don't even try to detect that your front-end is your genuine, unmodified iOS or Android app. Instead examine all the data that comes from the front-end and check if the data can be trusted or not, not the application sending it.