If the app provides users access to a remote service, some form of authentication, such as username/password authentication, is performed at the remote endpoint.
If stateful session management is used, the remote endpoint uses randomly generated session identifiers to authenticate client requests without sending the user's credentials.
If stateless token-based authentication is used, the server provides a token that has been signed using a secure algorithm.
The remote endpoint terminates the existing session when the user logs out.
A password policy exists and is enforced at the remote endpoint.
The remote endpoint implements a mechanism to protect against the submission of credentials an excessive number of times.
Sessions are invalidated at the remote endpoint after a predefined period of inactivity and access tokens expire.
Biometric authentication, if any, is not event-bound (i.e. using an API that simply returns "true" or "false"). Instead, it is based on unlocking the keychain/keystore.
A second factor of authentication exists at the remote endpoint and the 2FA requirement is consistently enforced.
Sensitive transactions require step-up authentication.
The app informs the user of all sensitive activities with their account. Users are able to view a list of devices, view contextual information (IP address, location, etc.), and to block specific devices.
Authorization models should be defined and enforced at the remote endpoint.