Reputation: 23
I'm trying to build a secure remember me system that allow user enter in the app without insert credentials each time.
i found this: Add a "Remember me" checkbox in whitch was used sharedPreference that seems to me are not te best solution because every rooted phone can easily modify that params.
what's the best practice to follow?
Upvotes: 2
Views: 1388
Reputation: 13345
well the idea behind remember me is that you trade in their user name and password for some sort of auth token from your backend, and save that in shared prefs or SQLite. You SHOULD NOT be saving their username and password anywhere. You should be saving a token of some sort for them. if they dont have a token stored keep them at login, and if they do then take them to the main page and send that token to a backend to be validated, and log them out if it is not
Upvotes: 2
Reputation: 7046
You can save credentials in SQLite. Encode them and decode. You can implement own decoder if you want and saving credentials in SharedPreference.
Upvotes: 0