保持“仅会话” cookie, iOS
我正在创建一个连接到网站的应用程序，并且我不希望用户每次加载应用程序时都需要输入其用户凭据。网站返回一个会话 cookie（未设置到期日期）。我无限期地保留该 cookie 有什么问题吗？如果我在应用程序启动时重新加载它，它似乎可以工作。
谢谢！
I'm creating an app that connects to a website, and I don't want the user to need to enter their user credentials every time the app loads. The website returns a session cookie (no expiry date set). Is there any problem with me holding on to that cookie indefinitely? If I just reload it when the app starts, it seems to work.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
每个应用程序都有自己的 cookie 存储。因此，如果 cookie 没有过期，并且您没有删除它，并且应用程序也没有被删除，那么只要您愿意，使用它就没有问题。
编辑以下是一些有关更多意见和见解的链接：
我对此事的看法移动环境与桌面环境根本不同。“退出”移动应用程序与退出桌面应用程序与将焦点转移到桌面上完全不同。每次按下 Cmd-Tab 时重新进行身份验证
限制会话令牌的生命周期是一项有价值的安全预防措施，但如果服务器设计为允许会话无限期地持续，则可以在服务器端而不是客户端正确实现。因为桌面应用程序永远不会退出），那么没有理由不在移动平台上以类似的方式继续会话。
请注意，还有其他解决方案，例如将用户凭据存储在钥匙串中，以便您可以重复使用它们。这在许多情况下都是合适的，但它实际上是比无限期保留会话令牌安全性较低的解决方案。如果您要永久保留身份验证凭据，最好将其设置为单一用途的令牌（即会话 cookie），而不是多用途的用户名和密码。
Each application has its own cookie store. So if there is no expiration on the cookie, and you don't delete it, and the app isn't deleted, then there's no problem with using it for as long as you like.
EDIT Here are some links for more opinions and insight:
My opinion on the matter is that the mobile environment is fundamentally different from the desktop environment. "Quitting" a mobile application is in no way similar to quitting a desktop application. Quitting a mobile application is similar to switching focus on a desktop. You would not expect to re-authenticate every time you pressed Cmd-Tab.
Limiting the life of session tokens is a valuable security precaution, but is correctly implemented on the server side, not the client side. If the server is designed to allow a session to persist indefinitely (because the desktop app is never quit), then there is no reason to not continue the session on a mobile platform in a similar way.
Note that there are other solutions, such as storing the user credentials in keychain so that you can reuse them. This is appropriate in many cases, but it actually is a lower-security solution than persisting the session token indefinitely. If you're going to hold onto an authentication credential forever, it's better that it be a single-purpose token (i.e. a session cookie) rather than a multi-use username and password.
允许设置此 cookie 没有问题，每个应用程序都有一个 cookie 存储区，如果您需要检查 cookie，您可以从中获取，但我认为因为这只是一个会话 cookie，您只需要允许它存在并让用户利用 Web 服务，直到用户注销为止。
我也用我的一些应用程序做到了这一点。
祝你好运。
There is no problem in you allowing this cookie to be set, each application has a cookie store from which you can if you need to check the cookies, however I assume that since this is only a session cookie, you will only need to allow it's existence and let the user leverage the web service until such time the user logs out.
I have done this with some of my apps also.
Good luck.