First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right.
Login in for the first time:
1. On the mobile device hardcode a security phrase (ex: "superSecurePhrase@@!!".
2. Take in a username and password.
3. Use base64 to encode username+phrase and password+phrase.
4. Using https send this information to my server.
5. On the server decode using base64 with the matching phrase hardcoded on the device.
6. Hash password and save to DB, also hash username and save to DB.
7. Use AES algorithm to create a session token
8. Send session token to device.
9. Save session token to DB, and when user requests something, make sure they match.
To verify credentials it is pretty much the same process except username and password aren't saved, but instead queried for the DB and checked for a match?
Is this the general pattern used for this kind of thing?
1. Physical access to the device to retrieve the hard coded base64 phrase?
2. SSL Sniffing and acquiring the token?
Thank you for your help.