How to keep track of whether the user is logged in or not?

Question

Android

Hello everyone, please help me, I shoveled a bunch of information and everything was mixed up in my head, I just can’t figure out how to keep track of whether the user is logged in or not and with everything in the android application. Is it related to this? All that I understand comes down to such actions
• The user logs in and I send him a token (a random set of characters) and the same token as a hash is stored in the database on the server
• When he enters the program in the oncreate method, I see if he has this token (is it in shared preference), if it is, then I skip it to the profile window, if not, then to the login window
• Then he sends his first request to the server with this token, and if the hash of the sent token matches what is in the database, then I give it a sessionId (also a set of characters but with an expiration date) and also save it to the database (I save it in a clean view) along with its expiration
• Now the user signs all requests with this session id and on the server I check it for a match with what is in the database and with the expiration date, if the entire check passes, then I change it (!) Update the expiration time to the beginning and send it to the user . If it does not match what is in the database or the expiration date has expired, then you need to go through an operation to get a new session ID using the token in Sp, by comparing it with what is in the database, if it does not match, then the user is thrown out to the login window
It turned out to be a very long description, but can you help me figure out if I’m doing everything right or is it completely nonsense, and if it’s complete nonsense, then how should I do it? Thank you

Answer 1

I am far from Android development, but I can advise using JWT .
After the user provides a login and password, give him 2 tokens: access_tokenand refresh_token.
With access_token, the user interacts with your APIs, and with refresh_token, you give him the opportunity to refresh this pair of tokens.

Answer 2

The user logs in and I send him a token (a random set of characters) and the same token as a hash I save in the database on the server

already wrong!
Who sends the token through the control channel?
cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt...