The wristband that keeps you logged in — and what happens if someone copies it

You don't send your password with every tap. After login the server hands your device a token, and whoever holds it is treated as you. Tap to see it… Aliteq Syntax · Build Editor

After login your device holds a token, and sends it (not your password) with each request

An access token is short-lived; a refresh token quietly gets you a new one

Whoever holds the token is treated as you, so a stolen token is a stolen session

Your provider handles tokens, but you can still leak them. Never put a token in a URL, a screenshot, or a log line, always serve over HTTPS, and give people a real logout that revokes the session.…

What this means for your app

Read the full story

Aliteq The wristband that keeps you logged in — and what happens if someone copies it Read the full story on Aliteq