还记得使用部署到移动设备的纯HTML5应用程序的登录凭据吗？

Question

I'm mainly a back-end programmer but I have done some pre-mobile web development before.

If I create a native HTML5 app that is nothing but HTML5 and javascript (Zero native mobile app code), is there a way to remember login credentials? I see other apps do after the account creation on the mobile device.

Here is the process flow but I can't get my head around if #3 is possible with a non-native mobile app.

1. User downloads/installs mobile app.
2. They launch and it goes through an account create setup the first time.
3. The next time they run the app I was hoping it would remember who they are and pass me the appropriate credentials so I don't have to have the login screen each time they launch the app.

Answer 1

Once the user has successfully authenticated, you can pass a token from the server to the app, and store that token on the client app in either localStorage or indexedDB. Then use the token to log the person in. Make sure that the token is actually part of a serialized object which includes the token's expiration. For example:

"rememberLogin": {
    "token": "43f250704a6bc737c830cc43739973b14e67ada07dca378a1725c3106c8e4f0f607cf11e2a3a2b08e8c053c19ccc781faf4f549e0e42cf6e2fe3b018a35da0f513ffe577f6d241db54a83ef30584c06e",
    "expiry": "2018-09-10T16:35:00.304Z"
}

The token's expiration date as stored on the client is for UX purposes only (you can use it to force the user to be taken to the login form once the expiration date has passed). For security purposes, use the token's expiration as stored on the server (not the one on the client) to verify the token's actual authenticity. Also make sure that after each successful token-based authentication, you either delete the token in the database or flag it as having been used; also on the client, you should replace the old token with a new one.

I emphasize locally storing a token to facilitate "remembered logins," rather than locally storing the user's username and password. Never store the username and password on the client; if you do, they can be too-easily discovered, and they are much more sensitive then an unpredictable token with an expiration date. A token with an expiration date is the way to go.