Reputation:
How to keep logged in application even user closes app? Log in only if user logged out prior to closing application?
Upvotes: 0
Views: 2993
Reputation: 3838
I would avoid storing the users' passwords at all costs. It's a bad security practice, not to mention your app would likely not know if they changed their password out of band from your app/session.
If you are using a common token-based authentication, then you can use the concept of Refresh Tokens to keep a user logged in. Effectively when the user logs in the first time, you also request a Refresh Token. This refresh token can then be used in the future to get another access token without requiring a username/password. See this link for an example implementation from Auth0. That's the product we use.
Additionally, you should likely not use Refresh Tokens for web-based logins. For web-based logins it is more common for a user to log in on public devices (or someone else's device). So keeping them logged in for those scenarios may put your users at higher risk.
Upvotes: 0