保持电话应用程序登录的最佳实践是什么？ 令牌方法安全吗？

Question

Right now I'm learning how to develop apps in android and I would like to keep the user logged in even after the app is closed. I read here that I can use the android device id and a sent token to keep the user logged in. However, if later I decide to expand my application to iOS, Windows or other operation systems, is this approach still going to work? Is it safe to just use a token make the authentication? If so, how strong (how many characters) should be the token?

Thanks in advance

Answer 1

Use Shared Preferences to save the data in your phone & Clear the saved data when you want to logout.

 private ProjectUtils utils;
 pref = (this.getApplicationContext()).getSharedPreferences("login_credential",MODE_PRIVATE);


    //SharedPreferences
                            editor = pref.edit();
                            editor.putBoolean("login_status",true);
                            editor.putString("user_id", String.valueOf(userId));
                            editor.putString("password", String.valueOf(passwd));
                            editor.putString("boy_id", String.valueOf(loginPojo.getBoyDetails().getBoyId()));
                            editor.putString("boy_name", loginPojo.getBoyDetails().getBoyName());
                            editor.putString("boy_age", loginPojo.getBoyDetails().getBoyAge());
                            editor.putString("boy_phone", String.valueOf(loginPojo.getBoyDetails().getBoyPhone()));
                            editor.putString("boy_dlno", loginPojo.getBoyDetails().getBoyDlno());
                           // editor.putString("boy_user_id", email);
                            editor.commit();

Above code is for save the data in Unique key.

 if(pref.getBoolean("login_status", false))
                {
                    Intent intent = new Intent(SplashScreen.this,MainActivity.class);
                    startActivity(intent);
                    Log.e("LOGIN","Yes");
                }
                else
                {
                    Intent intent = new Intent(SplashScreen.this,LoginActivity.class);
                    startActivity(intent);
                    Log.e("LOGIN","No");
                }

Answer 2

Well, you have to store the user in the device and check every time the app opens if still there or not! here's an example..

In case the login done through a web request api, now inside the OnSuccessResponse of the web request I make a new object of my User model class and then save it using SharedPreference! I use a very awesome SharedPreference library called Hawk for that.!

               // code..
               @Override
                public void onResponse(JSONObject response) {

                    Gson gson = new Gson();
                    try { 
                        UserModel user= gson.fromJson(response.getJSONObject("customer").toString(), UserModel.class);
                        Hawk.put("user", user); // here I save the user object
                        Toasty.success(context, "Login was a success", Toast.LENGTH_SHORT).show();
                        Intent i = new Intent(context, MyHome.class);
                        context.startActivity(i);

                    } catch (JSONException e) {
                        e.printStackTrace();       
                    }
                }
               // code..

Now when user logs out just delete the object..!

     Hawk.remove("user");
     Intent i = new Intent(UserSettings.this, LoginActivity.class);
     UserSettings.this.startActivity(i);

When the app open again, check inside the first screen that shows.. for my case it's the Splash screen..!

     UserModel user = Hawk.get("user");
     Intent intent;
     if (user != null) //if the user is null then the user was deleted from the logout process!
     intent = new Intent(Splash.this, MyHome.class);
     else
     intent = new Intent(Splash.this, LoginActivity.class);
     startActivity(intent);