How should a mobile app store the user's auth token securely?
poze 4 months ago350 gadeen
In my mobile app I currently save the JWT in AsyncStorage / SharedPreferences. Is that secure enough?
Dyagnostik IA
Se IA ki fè l. Se pa yon repons — kominote a anba a konfime oswa korije l. Toujou verifye anvan ou fye l.
1 Repons
No. AsyncStorage and SharedPreferences are unencrypted and readable on rooted/jailbroken devices and through some backups. Store tokens in the platform's secure storage instead: iOS Keychain and the Android Keystore-backed encrypted storage.
- Expo / React Native: expo-secure-store or react-native-keychain.
import * as SecureStore from 'expo-secure-store';
await SecureStore.setItemAsync('refresh_token', token);- Flutter: flutter_secure_storage.
Good token design on top of that: - Short-lived access token (minutes), kept in memory where possible, plus a refresh token in secure storage. - Rotate refresh tokens on use, and support server-side revocation ("log out all devices"). - Never put secrets like API keys for third-party services in the app binary. Anything shipped in the app can be extracted. Proxy those calls through your backend.
Konekte pou di lòt moun si li te mache.
Sign in and verify your email to post an answer.