title: Handling login functionality for native app connecting to web service
body: <p>After extensive research, I have not been able to find a clear answer to my question.  Firstly, can anyone tell me the basic logic of handling "login functionality" for a native iphone app connecting to a web service?  For instance, the facebook app ask for a username and password immediately after launch, and from there you have full access to your account in all successive views of the app.  Each time you post something etc, you do not have to re-login... Can someone please explain this process to me?  Is it done through cookies or sessions?  is Keychain involved?  </p>
  
  <p>I have a semi-working app right now but I'm almost positive I could be doing it better and more securely.  Here is what I'm doing:</p>
  
  <p>1) Set up a local server with a database of users (username and password columns and other tables etc.) using mysql.  Wrote a simple web-service that takes in POST data and queries the database to check that the username exists... and if it does, that the passwords are equal.  Using sha1 hashing.  Echo true or false accordingly.  </p>
  
  <p>2) My app has an initial login screen with a 2 textfields (1 for username and 1 for password) and a button that calls the login method.  My login method does the following:</p>
  
  <ul>
  <li>init an *NSURL with a string (the url of my web service: @"http://webservice.com/login.php")</li>
  <li>init an *ASIFormDataRequst with that url</li>
  <li>set the post value with the password and email text in the text fields</li>
  <li>set the delegate to itself</li>
  <li>call startAsycronous on the request</li>
  <li>implemented the requestFininshed method to retrieve the "true" or "false" echo-ed from the webservice</li>
  <li>depending on the response, move forward to the next view, else, make an alert telling the user to retry</li>
  </ul>
  
  <p>So, my questions are:</p>
  
  <p>1) Is this secure for sending passwords?  (via ASIHTTPRequest and the POST method?)
  2) In the succeeding views, the user should be able to interact with their account (like posting messages and status's and pictures on the Facebook)  How do I persist the user's logged in status so that every time the user interacts with the database, I can ensure that the user is still logged in and that it's the same user?  For instance, the only way I can think of doing this is if I store a cookie on the users device with the username and password, and then every successive interaction with the web service / database, it does an authentication with the cookie values (username and password).  </p>
  
  <p>There has got  to be a better way of doing this?  Maybe sessions or cookies?  or by using keychain??</p>
  
  <p>Thanks for the help guys, and sorry for the long question!</p>
  
  <hr>