Sessions and tokens: the wristband that keeps you logged in

Lesson 3 of who are you: you don't send your password with every tap. After login the server hands your device a token, and whoever holds it is… Aliteq Sam Ortega · Build Editor

After login your device holds a token, and sends it (not your password) with each request

An access token is short-lived; a refresh token quietly gets you a new one

Whoever holds the token is treated as you, so a stolen token is a stolen session

Your provider handles tokens, but you can still leak them. Never put a token in a URL, a screenshot, or a log line, always serve over HTTPS, and give people a real logout that revokes the session.…

What this means for your app

Read the full story

Aliteq Sessions and tokens: the wristband that keeps you logged in Read the full story on Aliteq