I'm looking for best practices for writing secure session managers.
I'm making a table for the authorization token (UUID OR GUIDv4) with autoincrement, user_id, token, status (enum) then update status onPause() onResume() so when I update a token I get a new autoincrement to store with the token in shared preference. Then on token update I just insert the old token with the user_id in another table for history.
The problems that I'm having:
it's good for a single device but when I want to update like password and update token I will have to end all user sessions and only the one I'm using will be updated.
should I add timestamp and keep the autoincrement inserted for a certain time of token updates or days or should I let it insert new autoincerment?
Is it good practice or there is a better way?
I already read about:
shared preference exploit on root. Is Shared Preferences safe for private datas?
shared preference not secured even if I encrypt data. Android SharedPreference security
ANDROID_ID can be null and can change upon factory reset.
data will be not safe if sensitive data is exploited I came across this but could not find any other articles that approve the method he used SQL injection
I already use a prepared statement:
<?php
$db_name = "mysql:host=localhost;dbname=DATABSE;charset=utf8";
$db_username = "root";
$db_password = "";
try {
$PDO = new PDO($db_name, $db_username, $db_password);
//echo "connection success";
} catch (PDOException $error) {
//echo "Error: " . $error->getMessage();
//echo "connection error";
exit;
}
$user_id = $_POST['user_id'];
$stmt = $PDO->prepare("
SELECT
tableA.name AS name,
TABLEB.logo AS logo
FROM tableA
LEFT JOIN TABLEB ON TABLEB.id = tableA.id
WHERE tableA.id = :USERID ;
");
$stmt->bindParam(':USERID', $user_id);
$stmt->execute();
$row = $stmt->fetchAll(PDO::FETCH_ASSOC);
if (!empty($user_id)) {
$returnApp = new stdClass();
$returnApp->LOADPROFILE = 'LOAD_SUCCESSFUL';
$returnApp->LOAD_SUCCESSFUL = $row;
echo json_encode($returnApp);
} else {
$returnApp = array('LOADPROFILE' => 'LOAD_FAILED');
echo json_encode($returnApp);
}