Currently, I have a website that logs users in, and then keeps track of ther session using PHPs $_SESSION. I'm trying to transfer this to an android app, which means I can't use sessions to keep track of a users login. I was thinking that one way to get around this would be to generate a long authentication token on the server when the user's phone first logs in, which would then be stored on the phone. This could then be passed in the URL of any requests from the phone to the server, allowing the phone to acccess the user's data. How secure would this approach be?
3
1
Use JWTs: https://jwt.io/, they are in my opinion the best way to manage sessions, especially in API based communications. They also let you send any arbitrary info in the encrypted token, great for logging and debugging.
There is a PHP here that works well: https://github.com/firebase/php-jwt
0
It's safe, it's like $_SESSION.
But the server must ignore the token if a user clicks on logout or changes passsword. Good idea is to use HTTPS and update tokens over some time.
If it is critical application, you can use second factor instead of username and password.
The token should not be based on weak pseudorandom number generator or generated by a cipher. It's not safety.
PHPSESSIDand sent it into aCookieheader, it would be a PHP session. – LSerni Feb 19 '17 at 22:53$_SERVER['HTTP_X_SESSID']. – LSerni Feb 19 '17 at 23:01