In the current OWASP MASVS (as of now v0.9.3) we can find the following requirement for MASVS-L2 in Security Verification Requirements:

MASVS 1.12:
"Remote endpoints verify that connecting clients use an up-to-date version of the mobile app."

I'm wondering how central the point about 'endpoint verifying [...] clients' is. For example, if a client does a version check via service call, would this be sufficient in your eyes? (I.e. the client calls a service which tells him the the 'minimal required version', and the client can then force an update if necessary.)

The way I see it, if the client is compromised we can't really trust any info that it sends to the endpoint (such as its version number for a server-side check as proposed by MASVS 1.12). And if the client is not compromised, then it shouldn't matter if the version check is actually done client-side instead of server-side, right?

1 Answer 1


After talking to some of the authors of the OWASP MASVS document on their slack channel I think the answer boils down to:

  • It doesn't matter if this check is done client-side or server-side
  • Its goal simpy is to be able to force users to update off of old versions.
  • An attacker attacking the app could circumvent/beat this version check in many different ways independent of whether the check is done client-side or server-side.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .