With apps there’s two levels of validation that you can do, and only one is done by the OS. The most common, and automatic, is the verification of the chain of

With apps there’s two levels of validation that you can do, and only one is done by the OS. The most common, and automatic, is the verification of the chain of trust. On iOS this happens automatically if you use the standard network APIs against an HTTPS URL. You can take it a step further and avoid MITM attacks where the middle party is able to mint trusted certs by doing something called certificate pinning. This is a manual verification that the certificate used by the server you’re connecting to has certain properties that you know match your API server’s.