Question

I going to build a system which have 2 part:
1. PHP Website (CakePHP).
2. Mobile application (Android & iPhone).

User must login with usr&pwd to use my system(web and mobile application). But i don’t have a lot experiences with user authentication. What should i store: usr&pwd, token string. I want to find an “user authentication model” for my system (Web and Mobile application).

Is there anybody have experience about user authentication. Anybody know how to implement this?

Answer 1

This is what we do for our applications,

1. First we send a username and a password to the server from our application.

2. At the server, they authenticate the credentials and return a response which is combination of a request token and sucess flag.

3. In our applicatoin, we check the sucess flag. If its set to true, we save the request token and use it for all the next outgoing requests to the server.

4. Now when the server receives a request, it checks the database to see if a user has this token.
   If it does, it checks the time in which the last request was made.(This is to handle cases when user login is timed out.). If the difference between the current time and the last request time is more than the limit you set, you responsd to the application that a fresh login request is required to generate a new token. Otherwise you continue with the request and respond with the results.

   This is how the server side guys in my workplace does it. Im work on the client side. But this is basically what is done.

Edit: About the token.
Its basically a 32 character string which is generated with a random generator method. So when a user sends a login request and the login is success, we create a token using the generator method and store that into our server database as the users request token along with the current time and date.

So when the user sends another request to ther server, we first take the token and check if a user exists with that token. If there is, then the next check is to see if this is some old request token. So we check the current time with the time saved in the database. If the request was sent before the limit (Eg 5 mins) then we update the last request time in the database with the current time and return the result to the client.

With this method you are kind of doing an authentication for each request by checking the token and the last request time.

Suppose you want your app to be logged in all the time until the user explicity logs off. In that case you do not need to check for each request time. All you need to do is save the request token on the client device. And when the user signs out, delete the token from the client. So he will be required to login the next time as he has no token. Its a bit more secure to save a request token on the client device than saving a username and password in this scenario.

There are many functions out there for generating random tokens.