title: Flutter Security
body: <p>I am creating a Flutter app which uses Node Js server API. For the authorization I decided to use JWT with private/public keys. Communication between Server and mobile client uses HTTPS. Flutter app stores the token in a keychain (ios) or a keystore (android). My question is related to the need of the additional security measures implementations. I am wondering if the following points are required:</p>
  <ol>
  <li>Verification of the server responses with public key by checking the token to identify the server</li>
  <li>Verification of the client requests with the private key on the server side (client signs the token with public key)</li>
  </ol>
  <p>Are these really needed in order to avoid man in the middle attacs? My objection is related to the performance related to signing/verifying tokens for each communication.</p>
  <p>Thank you</p>