New answers tagged

1

You can also set up token-based authentication with your own user database. To create a token, you offer an endpoint like /login. This endpoint would require a username/password combination for authentication and it would return a token that is unique for the user and valid until the next time you want to ask for a password. This token can be stored in the ...


0

The architecture you described is pretty common so far, I think you are missing just one thing: In case that your app and your backend reside on different domains, you can't use cookies any more to store the token. The typical process would be: user posts credentials via app to backend, backend creates a token, app stores the token in localstorage. On every ...


0

I think its low risk. The main worry I would have is that maybe they will be calling it all the time instead of keeping their token. But there are a couple of worries. Do you now have to keep a db of access tokens? That ia a new attack vector What about token expiry? do you refresh the expiry date or send an indentical token? What about refresh tokens? arr ...


1

You could query WHOIS for the creation date of the domain name. If it was registered today, then the e-mail address must also have been created today.


Top 50 recent answers are included