How to keep app in session state after a login
after logging in once, you can open app to operate the interface session without logging in once
.
what I imagine is implemented like this. I don"t know whether it has much impact. After the first login is successful, the token is returned to the client, and the client is stored in Local Storage. The next time the app is opened, silently access and verify the interface of the token in the app startup diagram. If the token verification is successful, parse the user_id in the token and keep it back to session.
but in this case, is there any impact on security?
is basically reasonable. With a small correction, it is best to let the server verify that the token, client does not do any verification and parsing actions. If you need user information, just return it from the server. It is better for the client to save token as meaningless garbled code, so it is safer.
the first thing to be clear is that you don't need to care about session
.
maybe what you did before was web . For web, we usually use session
to record login credentials, so when you do interface development, the first thing that comes to mind is session
.
in App, all requests are stateless, so people usually use token to verify login
.
when the client requests a login interface, a generated token
is returned.
when the request requires a login interface, the client directly passes this token to the backend
.
two main things the backend does
- check whether the token is correct (that is, your solved user_id)
- verify whether token is out of date
if the above verification is correct, the user is considered to have logged in successfully ~
for an introduction to this, you can take a brief look at jwt
.
1. Set the token, such as adding salt to md5+, and then make the timestamp random, and save it to session, for a certain period of time, but generally speaking, it is highly secure. Each request is sent to the client with unique token randomness, which increases security.
2. Sign signature can be performed.
jwt.io, you can deal with token every time
