I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server. However, how should I handle communication between the phone and server through the API, when the user wants to login?
Should I make another hashing function inside the app, send the hash to the API, and rehash it? I don't know how safe it would be to directly send the account's password in the API call, but I imagine it's a very bad idea.
Furthermore, how should I store the account's credentials on the device? For reference, I am developing for iOS devices, so data would be stored in an encrypted sqlite database. I suppose storing usernames/emails is fine, but what about the password? Should I create some sort of token that is sent by the API when logging in, and then have the device send the token when the app is opened to make sure the credentials are still valid? Could I store the hashed version of the password and have an API call that directly compares an input hash with the stored password hash?
Any help and tips are welcome!