I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server. However, how should I handle communication between the phone and server through the API, when the user wants to login?

Should I make another hashing function inside the app, send the hash to the API, and rehash it? I don't know how safe it would be to directly send the account's password in the API call, but I imagine it's a very bad idea.

Furthermore, how should I store the account's credentials on the device? For reference, I am developing for iOS devices, so data would be stored in an encrypted sqlite database. I suppose storing usernames/emails is fine, but what about the password? Should I create some sort of token that is sent by the API when logging in, and then have the device send the token when the app is opened to make sure the credentials are still valid? Could I store the hashed version of the password and have an API call that directly compares an input hash with the stored password hash?

Any help and tips are welcome!

  • Take a look at OAuth. It's a mature framework used for lots and lots of services. It can help you. – ThoriumBR Nov 26 '20 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.