Android，使用Rest API登录

Question

I have an android app with a login that sends login information over https to a java rest api that verifies the login credentials and then sends back a response stating whether the login was successful. My question is simple, what should I do to make sure the user doesn't have to login in again when they restart the app?

Answer 1

There are many ways to deal with one time login, it depends a lot on how the architecture is implemented on server side to make it work. Usually Login API are closely coupled for security reason. let me example what I mean by closely coupled .

As you want to Login in to Mobile App work once and the next time user opens the Mobile app you don't want to prompt user with SignIn screen again. and surely you don't want to save the confidential information like Username and Password on Mobile app as persistent data, as it can be fetched easily from android device. so what you do.

Lets assume you pass login credentials with a deviceID unique to the Android Device . Something like shown below. following is the JSON data sent to the LoginAPI

{
    "username": "example@example.com",
    "password": "it's not a secret",
    "deviceId": "123456789"
}

Now as you don't want to save the Login credentials, server will generate a random alpha numeric String pass it to you in response every time you login to the Mobile App.

{
    "Success": true,
    "SuccessMessage": "credentials are correct, really!",
    "ErrorMessage": null,
    "Date": "dd/mm/yyyy",
    "token": "1eghe4qha23aehraeh456789" // now this is a nasty String
}

you may now save the date and the token in Mobile App as persistent data. So next time your user opens the app you may let user bypass the SignIn screen, and in background you can check if users token id is correct by sending that to the server, something like this. you may choose SharedPreferences or create a file and save it there

{
    "API_TYPE": "login",
    "deviceId": "123456789",
    "token": "1eghe4qha23aehraeh456789"
}

Server may check this token id against the deviceID to check if this was the correct token for the device and respond.

You may ask why are we checking the token again as this was sent by the server in first place stating the credentials were correct. I agree you do have a point, lets say it is a fail safe condition, if the user changes the password from the website or something which causes to change the token on server for that user to change, if the server denies the token provided by you just ask the user to login again.

This will make sure that a user is logged in to only one Android Device at any given point of time.

Answer 2

You can store the credentials after the first login. So when the user restart app, you can automatically make the request auth.

You can chose the best option to storage the credentials using the doc: Data-Storage

This is simple, but maybe not the best way to do this.

Answer 3

I have the same problme,and I got a Json data from the server like this

{"error":0,"message":"ok","token":"7c75015e92e40511911e34752ee456e1","execute_time":"0.2723"}

so I keep the StuToken in SharedPreferences,and when my app start,check the StuToken does it exist,like this

Map<String, String> loginInfo = InfoUtil.getLoginInfo(MainActivity.this);
    if (loginInfo != null) {
        if (loginInfo.get("StuToken") != null) {
            getStuInfo(loginInfo.get("StuToken"));
            Toast.makeText(MainActivity.this, "登录状态", Toast.LENGTH_SHORT).show();
        } else {
            initIntent(LoginActivity.class);
            this.finish();
        }
    } else {
        initIntent(LoginActivity.class);
        this.finish();
    }
}

hope that will works for you

Answer 4

You can use shared preference to store the values of the user and to check whether the user is already logged in or not. You can follow this Link.

Answer 5

Try out this code in your SplashScreen Activity.You can store a value in a sharedPrefence to check whether user is Logged in or not.

public class SplashActivity extends AppCompatActivity {

    private static final long TIME_OUT_MILI = 3000;
    private SharedPreferences mAppPreferences;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_splash);
        mAppPreferences = AppUtil.getAppPreferences(this);

        new Handler().postDelayed(new Runnable() {

            @Override
            public void run() {
                if (mAppPreferences.getBoolean("is_Logged_in", false)) {

                    startActivity(new Intent(SplashActivity.this, MainActivity.class));

                } else {

                    startActivity(new Intent(SplashActivity.this, LoginActivity.class));

                }
                finish();
            }
        }, TIME_OUT_MILI);
    }


}

In Your LoginActivity's do this:

public class LoginActivity extends AppCompatActivity {
 private SharedPreferences mAppPreferences;
  protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_login);
          SharedPreferences.Editor editor = mAppPreferences.edit();
editor.putBoolean(Constants.SETTINGS_IS_LOGGED_IN, true);
                        editor.commit();
}
}