Currently, I have a website that logs users in, and then keeps track of ther session using PHPs $_SESSION. I'm trying to transfer this to an android app, which means I can't use sessions to keep track of a users login. I was thinking that one way to get around this would be to generate a long authentication token on the server when the user's phone first logs in, which would then be stored on the phone. This could then be passed in the URL of any requests from the phone to the server, allowing the phone to acccess the user's data. How secure would this approach be?
It's safe, it's like $_SESSION.
But the server must ignore the token if a user clicks on logout or changes passsword. Good idea is to use HTTPS and update tokens over some time.
If it is critical application, you can use second factor instead of username and password.
The token should not be based on weak pseudorandom number generator or generated by a cipher. It's not safety.