This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit.
On my mobile app, I am storing the username of a logged in person, and downloading some data for the given/stored username. When the user checks for updates to his data content on the server, the server dishes out a delta of the content, based on the username. The app then updates its local display accordingly.
The problem is, since I am using localStorage, there is no guarantee that someone will not edit the username stored locally and try to request data meant for someone else.
What would be the best way of getting around this possible security hole? Please comment on this method that I am planning to implement:
- Each time you login, a random string is generated and stored for future checking in a database, along with your username, and date/time of request.
- Whenever a request to download data for a username comes in, it must be accompanied by the string from the previous attempt. Also, each fresh update for the client is accompanied by a new random string, which is stored in the database and the old one is deemed expired.
- If the random string is not provided correctly, the user is logged out of the mobile app (as this could potentially be someone tampering with the app).
The advantage I see for this method is that I have an audit trail as well for later verification and forensics. What are the flaws and what could I do better?