How to handle user authentication in iOS?

Question

I am trying to create the foundation for my iPhone application and server. I have users who will register and log in to the iPhone app. In a typical website login, the http server will provide cookies to allow subsequent user requests to remain authenticated. How do I do this on an iPhone? Should I just send the user / password every time I have an NSURLConnection GET or POST? It seems excessive. Or I use the ASIHTTPRequest structure to use cookies. Can someone point me in the right direction for the correct implementation?

Thanks!

Answer 1

Sending username and password in each request is small.

You can use everything you want to send cookies. This is just another HTTP header. But this raises the question of what is in the cookie. It depends on your client / server architecture. Web applications use session keys because traditionally web clients have no state, which is why the application server should have. Own clients can have all kinds of states and, as a rule, do not need a server to provide this.

But you need authentication. What are OAuth and OAuth 2 for ? They allow you to authenticate once, and then use tokens that may be invalid on the server side. Kind of like very long-lived sessions without data.

They are a little complicated, but there are open source libraries for both server parts and clients, or you can minimize your own. Most of the difficulty lies in obtaining the original token, which you can short-circuit if you have a client and server. OAuth can become quite complex because all requests are signed with a secret token. OAuth 2 can be as simple as a shared secret (requiring SSL) in a cookie.