Do I need to use PHP sessions in my Android app?

Question

I have created an Android app that communicates with a PHP web server. They both send JSON to each other. My app is almost finished, however there is one thing left to do: authentication.

Since the user's username and password will be stored in Android SharedPreferences, is there any need to use PHP sessions, given that the user won't need to enter the username/password at every request?

Since I can just send the username and password in the HTTP POST header for every request, and that I will be using SSL, is this sufficient? I guess I could add an extra field in the header called 'random' that just adds a random value, just to use as a salt so that the encrypted SSL payload will be different every time.

The reason why I don't want to use sessions is that my Android App would either have to handle cookies, or managed the storage of the session ID.

If there are some serious cons to using my method above, then I'm more than happy to use sessions.

Answer 1

Personally, I'm against sending the username and password in the request each time. One thing you could do is generate a unique ID when they log in, and store that in a database on your server, then just pass that instead of the username and password.

Answer 2

I believe that you will be fine with what you have now. As long as you make sure that the user info is securely transfered. The salt is a good idea. It really just depends on how secure you want it.

Answer 3

It is very bad practice to send account credentials in every request. I think the better way to use Google OAuth2 API - it is VERY simple and safer than local accounts database. Have you considered that option?

Answer 4

I think Google have given this a lot of thought, so doing something similar to what they do wouldn't be a bad idea. If you look at the way they do their

• login process, ie https://accounts.google.com/o/oauth2/auth

and especially their

• token freshining, ie https://accounts.google.com/o/oauth2/token

it might feel like overkill, but you might come away with some ideas that could be valuable to your own implementation.

EDIT: oops, almost forgot the documentation link: https://developers.google.com/accounts/docs/OAuth2