Overview#
Field apps fail security reviews for predictable reasons: tokens stuffed into insecure storage, home-grown cookie formats that drift from the browser platform, route menus that show tiles the server would never authorise, and background behaviours that keep tracking after someone goes off duty. Responder and workforce mobile users still need a session that survives app restarts, works on issued and BYOD devices, and feels continuous when they arrive from a desktop handoff.
The Native Mobile Session Contract is the platform authentication answer for those clients. Authorization codes are persisted and consumed atomically. Service-owned cookies, not per-app improvisation, carry the established session. Mobile route gates read the same role vocabulary as the server catalogue. Off-duty and sign-out paths stop background location and flush or pause offline work that should not continue. Opaque service handoffs redeem into this contract so web-to-mobile continuity does not become a second login product.
Ambulance trusts, utilities field forces, and public-safety programmes buying a mobile companion to Argus can evaluate this module as the identity and session backbone behind clinical, fireground, CFR, and workforce screens, rather than treating auth as an afterthought bolted onto each feature.
Last Reviewed: 2026-09-15 Last Updated: 2026-09-15
Key Features#
-
Service-owned cookies: Session cookies are defined by platform authentication cookie composition rules shared with the wider platform, including secure and host cookie priority behaviour. Mobile clients do not invent a parallel token jar that security cannot reason about.
-
Atomic authorization code lifecycle: Codes persist in the platform store until redeemed or expired. Redeem is atomic so the same code cannot create two sessions. Migration gates keep mobile auth storage upgrades from going live before persistence is ready.
-
Authority-aligned navigation: Mobile roles align to the platform role catalogue. Restricted destinations check grants, not only menu visibility. Honest denial screens appear when a role cannot open ePCR or other gated modules.
-
Workforce mobile permissions: Explicit workforce mobile permission grants land in the RBAC catalogue so field workforce features are authorised with the same discipline as desktop workforce suites.
-
Web to native handoff: Opaque service handoffs redeem into the native contract, supporting supervisor and dispatcher flows that begin on glass and continue on a handset.
-
Duty-aware cleanup: Off-duty transitions stop background location tracking and apply offline queue policy so the device stops acting like an on-service endpoint. CFR availability does not survive sign-out honesty requirements.
-
Passkey step-up adjacency: Hardware passkey step-up in the authentication service compose with mobile and web session policies when a higher assurance action is required.
-
Fail-closed clinical and governance gates: ePCR and governance surfaces deny cleanly when auth says no, rather than showing half-loaded clinical UI.
Use Cases#
-
Paramedic shift start: A clinician signs in on an issued handset, redeems into a service-owned session, and only sees routes their clinical and responder roles allow before opening ePCR or incident tools.
-
Utilities field crew: A mobile worker receives workforce grants, works offline-tolerant jobs under the responder/workforce clients, and drops tracking when they go off duty.
-
Supervisor desk to roadside: A supervisor hands off from the desktop console into workforce or responder mobile without retyping a password in a vehicle cab.
-
Volunteer CFR schemes: Availability and paging sit on the same session honesty model: server-confirmed states, sign-out cleanup, and role gates.
-
Security accreditation packs: Single redeem, service-owned cookies, catalogue-aligned gates, and audited handoffs give assessors an architecture narrative that matches the running system.
Integration#
The authentication service owns authorization-code persistence, redeem, cookies, role catalogue entries, and handoff redeem. The responder and workforce mobile apps implement the client side of the contract, including route gates and duty transitions. Argus web applications issue handoffs when crossing into mobile. Platform services continue to enforce tenant and permission checks on API traffic after the session is established.
Open Standards#
- OAuth 2.0 for Native Apps (RFC 8252): Authorization code usage on mobile follows native-app guidance for public clients.
- OpenID Connect Core: Identity claims in the established session align with OIDC practices used platform-wide.
- RFC 6265bis cookie semantics: Service-owned cookies obey modern cookie attribute rules for secure transmission and scope.
- FIDO2 / WebAuthn: Passkey step-up uses platform authenticators for higher-assurance actions.
- WCAG 2.2: Denial and session status surfaces remain operable and named for assistive technology.