在iOS上存储身份验证令牌

Question

I am building an iOS application and the user authenticates with my web service. I don't want them to login every time the app launches (the token lasts a month). So I'd like to cache this on the device somewhere.

What's the best way to do this, securely?

Can I just rely on the app remaining suspended and keeping the token in 'memory'?

Answer 1

2 options

• Make use of NSUserdefault (store as access token or textfield inputs[Remember me option])
• Keychain access(recommended) for doing the job.

NSUserdefaults is not secure for storing such credible values which is for authentication purpose.Keychain on the other hand is made to do this,safe and secure.

Answer 2

You can't rely that iOS will keep your application forever in the memory. So, you have to save the token to persistent storage at some point.

Look at Keychain Service for iOS . This is the best place to store things like passwords, tokens and other keys.

Answer 3

You can't do it "securely." A token is public knowledge, and as soon as its on your device a hacker could gain access to it no matter what you try to do to protect it. Putting it in the keychain won't change this fact. Even if you store it there, which would make it secure while it's in there, they can simply wait until it expires then snag the next one when it comes in over the wire next time. Your access tokens aren't the thing you need to worry about securing, because you can't, in fact, do that in a mobile environment.

What this means is that you can store it anywhere you'd like. NSUserDefaults is fine, the keychain is fine, a database is fine, a text file in your documents directory is fine. All of them are equally secure because a determined hacker can simply wait for the right opportunity to access the data they want. You should instead worry about securing your users' authentication credentials. Make sure you store those in the keychain, and only ever communicate with your API over HTTPS to a server with a valid SSL certificate.