如果令牌过期怎么办

Question

I have communicate with API using retrofit. When the user is log in, I save account to database and when the user go to app next time, I get data from database (so I skipped login screen). Problem is when user's token expires. How to handle the situation?

in login fragment PSEUDOCODE

user = ... //get user from database
if(user != null) {
   startActivityAccountActivity();
} 
//onButtonClick
emailLogin(); 

Answer 1

It depends on your back end security level. You have two options to handle this situation.

1. Build some mechanism on back end side so that your server will send some refresh-token along with the user's token at the time of login to Android device. Whenever user's token get expired then request from Android device to your server to obtain new user's token by sending old user's token along with refresh-token . And you can use that new user's token for future. Repeat this whenever user's token get expired.

   Note - refresh-token is for validating if it is valid resource who is requesting for a user's token .

2. You can delete the user account from database and tell user to Re-Login.

Answer 2

Don't go to your "logged in" activity just because you have a token saved, because as you have correctly noticed, it may be invalid. Try authenticating with the API when you get the token, and only go to the "logged in" activity if it indeed worked. Otherwise proceed as if there was no token saved (and remove the expired one from the database).

You should also note that the token may expire when the user is in the "logged in" activity. For example, the user logged in, used the app and then went to another app from the recents screen. A week later he/she returns to your app with the "logged in" activity open, but in the mean time the token has expired and nothing will work. So you should also check if the token still works there, maybe in the onStart() of the activity.

As indramurari said, you can also handle it on the backend if you control it. But keep in mind that it doesn't solve your inherent problem of handling expired tokens, a refresh token may also expire and you are back to square one. If you make refresh tokens not expire you can just make the login tokens not expire. (This paragraph would be a comment on his answer, but I don't have enough reputation.)