I currently have an app in development where I use services 3 on drupal 7 to login to my site. I do this by simply passing in the username and password parameters to a json object and use httppost to post them to service endpoint. Using the response I grab the cookie and store it in sharedpreferences on android which is used in all the following requests. I have this cookie set to be used for several days so the user wont require login again. Do I have any reason to be concerned about the security of this (I dont store any passwords) and if so what are the extra steps I can take and how to beef up the security but still allow for users to remain logged in? I have played around with the oauth module a bit but it seems rather complicated to implement on both drupal side and android. If oauth is my best option what are the steps to take to implement it with drupal and android?


You can use Android AccountManager over https to be more secure. Like this Drupal 8 Android app at https://github.com/onedrupal/One-Drupal-Android.


You should definitely be doing some sort of encrypted key exchange, otherwise someone could post the login info to their own server and respond with a positive result!

I've never used the module you're referring to, but Drupal bootstrap is VERY easy to set up.


I think logging in then using the session id as a key for authentication is ok there. However, to make it more secure, you should do all the API requests containing the session token over HTTPS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.