Question

I want to have a user profile system in an app; this app has absolutely no sensitive data. I know how to do a secure log in as far as protecting the user password/username etc. But here is my question… once the login confirms that the username/password combo is correct, can I do this:

Use Sharedpreferences to set a login variable from 0 to 1. When the user logs out, it goes back to 0.
So anytime there is a function in the app that needs to check if the user is logged in, it just checks the state of this preference variable.

Is this a secure way of doing it? Or is there a better way?

(Normally in PHP I use session variables, not sure what the Android equivalent is.)

Answer 1

Don’t use shared preferences, there are too many things that can go wrong, e.g. your app FCs or is killed by Android and has no chance to update them.

You can override the Application class and use a static value, boolean perhaps, to indicate that the user is logged in.

Here’s some pseudo code showing how to override the Application. It’s similar to a global variable but don’t overdo this and put all your data here 😉

public class MyApp extends Application{

    public static boolean isUserLoggedIn = false;
    ...

public void userLogin(){

   MyApp.isUserLoggedIn = true;
   ...

public void userLogout(){

   MyApp.isUserLoggedIn = false;
   ...

}

Because the field is static and initialised to false, everytime your app starts, you can guarantee that it’s false. The only way it can ever be true is if it’s set in your app in code.

You also need to add the extended class to your manifest:

<application android:name=".MyApp" 
  ...