Securing communication from android to a web servi

问题:

I'm a relative newbie to web and mobile development and especially to security so obvious answers are still appreciated.

I want my android app to be able to log in to a simple web service with a username and password.

What's the best way to send this information securely and keep the user logged in for an entire session?

回答1:

Do you control the web service? If not then you will need to use whatever authentication mechanism the web service provides.

If you're writing the web service yourself, you have a lot of options.

The simplest is to just send the user's username and password via SSL with every request as a HTTP Authorization: header. The downside here is that you need to keep the username and password stored on the device. That being said, because of the way Android's permission system works, there's very little risk of an attacker stealing credentials off of the device, provided the user hasn't enabled root access.

If you still want to avoid storing the password in plain text, you can send the username/password once (again, using SSL), have the server return an encrypted authorization token, then send that token in place of the user's username/password. See Google's ClientLogin for an example of this. An attacker could still steal the token if they have physical access to the device, but at least the attacker can't use that to gain access to any other sites that use the same password.

There's other options out there as well, like using challenge/response to prevent the server from ever seeing the user's password, using OAuth to provide a common authorization API, and so on. It all depends on what your particular requirements are.

回答2:

A friend and I are looking to do this same thing, and I think that we've settled on storing a web service key unique to the user on the device, and using that for authentication rather than storing un/pw (this is the second method provided by Trevor above). You'll need to make sure to provide for a means for getting that key onto the device as well.

回答3:

You can use a server based random key and local imie based key along with users unique token for making a logic .you can put an expiry time for every key