I am developing an iOS application and web page, both use same Parse backend.
Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the user an option to open home page from app. As user has already logged in before in the app I would like to skip the login process when home page is opened.
I have a solution in my head for which I would like your opinion. When the user clicks on a link in the app, the app would call e.g. generateToken function in Parse which would create a random token, store it DB with some expiration date for this user and return it to the app. The app would then open the web page with query parameter token=newly_generated_token or pass the token value in the http headers if that can be accomplished.
On new request the server code would check if parameter (or header) token exists, check the db for token value and log in the appropriate user where match would be found. Afterwards the token would be invalidated. If the request would not contain any 'token' parameter the usual authentication would go through and login page would display. All comunication would be over https.
I get rid of replay attack by invalidating token when used. Is it vulnerable to any other attacks? Or is there any other way of doing this?
Any help appreciated. Thanks!