How to implement authorization on Android + PHP API?

Question

PHP

Hello.
The question arose of how to correctly and safely implement authorization in an Android application on a remote server with REST (at least I would like to believe it :)) API written in PHP.
Now the scheme is as follows:
1. The user enters a login and password, they are sent to the server using a POST request (an address like www.mysite.com/api/v1/login).
2. If everything is OK (login and password are correct) - the server returns information about the user (name, date of registration, etc.) along with ApiKey - this key is randomly generated at the time of user registration.
3. All operations in the application occur using this ApiKey - it is given to the server in the GET/POST/PUT header of the request in the Authorization field. The server looks it up in the database, if it doesn't find it, it issues an HTTP 401.
It is necessary to implement some mechanism in the application, like a "Remember me" checkbox. Those. if the user has successfully logged in - do not ask him for more login and password until he forcibly presses a certain "Logout" button. It is not safe to store a login/password combination in SharedPreferences or sqlite, just like storing an ApiKey there.
Can you please tell me if there are any specially designed places for this? Or maybe the dog is buried somewhere else?
Thanks in advance for your reply :)

Answer 1

Almost a year has passed, but still)
I am doing this now. the user logs in, we create a session for him, the session key is in cookies. Together with him in the cookie, the token encrypted with the crypt function is put into the database. the session is over - decrypt the token and check. OK - we issue a new ses key, it doesn't fit - get out)

Answer 2

Store the hash of the username and password. and send it to the server after 401 or for authorization.

Answer 3

I wonder what kind of thoughts they came up with when they came up with a thing with ApiKey that is generated 1 time during registration?
The password and login are not stored on the client, everything is correct. ApiKey is yours, too.
Look at how authorization is implemented in complex systems, because they have a session token everywhere. I recommend you use it too.
The scheme is as follows: on the server, somewhere, store user tokens. The token has a session end time. like a couple of days.
On each request, pass this token and extend the session time by the current time + your session expiration time. If you passed an outdated token, write suspicious data to the log.
It turns out such a situation. The user is active - you can log in only once.
The user comes in once a week, so if you please log in. The token itself should be stored on the device and it is desirable to encrypt it.
Use HTTPS, but you can also think of something like that. The encryption key is your ApiKey which knows the device and knows the server. In this case, when transmitted over the network, it is incomprehensible.

Answer 4

API KEY, which is generated during registration, you can not set an expiration date at all, just a token that is always valid, the only thing you can write is a function to change this token, well, if users want to.