2

Recently we started working on a mobile payment app.

We are not looking for a way to implement a "Remember me" function. We wondered if we should use session cookies, JWT or maybe other method of remembering user. Our questions are

  • Is it safe to implement a functionality to remember user in payment apps
  • How would you go about it? How long should be the expiration time
Also, it's worth noting that we would like to always keep user logged in in our mobile app (it will require PIN before every payment anyway)

Improve this question
9
  • If by safe, you mean 100% safe, then no. If you mean 'safe enough'; what is safe enough? Also, how safely can you guys store and enforce the tokens that allow that memory? I think you might be better served by an enumeration of the potential attacks/downsides
    – J.A.K.
    Jul 15, 2018 at 16:52
  • Also, please don't handle payments if these questions are anywhere near new to your organisation. Have an external provider handle the security, or hire someone who can answer these questions internally instead of here.
    – J.A.K.
    Jul 15, 2018 at 16:56
  • 1
    You don't have to worry. I'm asking because I'm working on an MVP, and I wanted that knowledge. As soon as we move to the next phase (that is, if we get funding), for actual app we will hire a specialist
    – Dawid Cyron
    Jul 15, 2018 at 17:22
  • Ah in that case sorry for being pedantic. But providers do use it, so it can be done. How you would go about implementing a secure session cookie within the framework you will use, and how much effort that will cost, how 'doable' it is with your resources, is the question you're after in my view.
    – J.A.K.
    Jul 15, 2018 at 18:18
  • 2
    Alright, thank you very much for your help. And being pedantic is great in this case, you never know, maybe someone would want to implement real banking system without proper knowledge, risking safety of their users.
    – Dawid Cyron
    Jul 15, 2018 at 18:20

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.