I'm programming a mobile app which makes use of REST services.
Some of the services are for logged users, so I have a login endpoint which lets me enter my credentials and get a JWT token for accessing protected APIs.
I want to be able to login one time and have the app remember me without asking me to login again each time I close and reopen it.
I came up with two choices so far:
- Make a long lasting JWT, which doesn't expire. That way, I can just save it and use it each time I'll need to access protected APIs. This can be unsafe because if the token goes in wrong hands, the "hacker" would have an access key that never expires. That potentially is a permanent access to the application.
- Save username and password in the app's local storage. That way I can have expiring JWTs that can be refreshed, and if the last token expired I can call the login API again with the same username and password to obtain a new token. This can be unsafe because I'd be saving the user credentials on the phone, it seems risky to me.
So what is the common approach to this issue?