Develop Reference

Android login panel: what are the security aspects should consider

I'm creating a android app which requires login and the authentication will be done against a node server.
HttpURLConnection is used with the POST and I'm using HTTPS. But my question is, since username and password are sent to the server as url parameters, do I need to add more security measures; like encrypting those two parameters(Using Base64)?
I've tried to use Authenticator.setDefault(new Authenticator(){}) but I'm not user implementing that only would be enough.

The URL parameters are encrypted thus protected in transit but are probably logged by the system so the username and password will probably be in the log files. It is best to send then in thee POST data, not as part of the URL.

What you can try is encrypting the data and then send it to server and on server side the data should be decrypted . In this way the security of your app will be maintained.
See this

CakePHP 3: validating user from mobile application

I'm working on a project which has Web Application and Mobile client. I'm using CakePHP 3.2 for developing web application. There is a table users to store user credentials and register login logout function.
I'm using DefaultPasswordHasher of CakePHP 3.
Now, I want the user to be able to register and login using Android/iOS application using the same users table and login using the hashed password generated by CakePHP or hash password while registration so that CakePHP web client can be used to login.
I'm a learner and new to CakePHP and Android.
How could I do it ?
The main problem is with the hashing of password field because CakePHP uses different technique to hash password every time.
Edit 2
login action of UsersController in CakePHP project is configured to authenticate user and return to some other action. But I want to retrieve user's data after validating.

if you want to retrieve user's data, dont use return $this->redirect().
just use something like this :
$user = $this->Auth->identify();
if($user){ return $user; }

Using same user table you can register login and logout in your web application and android application .
please check this link login. its help you to solve your issue.
thanks.

How to use OAuth on android to pull data into our server(not to phone)?

I have 3 entities:
1.Android Phone
2.Local Server
3.Fb Server
I want user to login from his phone on to FB , but once authenticated , I want to be able to pull data into local server from FB(no data on to phone).
What is the best way to do this ?.
Is there a way to do this using oAuth ?

This is certainly no problem. Just implement the server-side authentication flow on your web server. Instead of placing a login button on a website where you redirect the user to the Facebook dialog, you open the browser on the smartphone (or embedd a Webview) with that URI. The redirect_uri then points to your web server callback, where you receive the authorization code. Then you exchange that code for an access token by calling Facebook from your server and you're done.
On the phone, point the browser to:
https://www.facebook.com/dialog/oauth?
client_id=YOUR_APP_ID
&redirect_uri=https://YOUR_SERVER/YOUR_CALLBACK
&scope=COMMA_SEPARATED_LIST_OF_PERMISSION_NAMES
&state=SOME_ARBITRARY_BUT_UNIQUE_STRING
After handling the callback, issue a request from your server to:
https://graph.facebook.com/oauth/access_token?
client_id=YOUR_APP_ID
&redirect_uri=https://YOUR_SERVER/YOUR_CALLBACK
&client_secret=YOUR_APP_SECRET
&code=AUTHORIZATION_CODE_YOU_RECEIVED

How to Login Vtiger from my Android Application using Webservice

I am using vtiger CRM - 5.4.0. I want to a create an Android Application to access Vtiger from my Android Mobile. How to call a webservice from my Android Application to login,create record in Viger. Is it any special webservice available in Vtiger?
*Note:* Also i tried to login like(Webservices tutorials) using HttpUrlConnnection in Android.I got challenge token,while login error returns as "invalid token or token expired".some other webservice available for mobile?

Vtiger provides Web service Client library for Java and java script.To download vtwsclib-1.4 library and its documentation go here. This API provides all web service operations.

Hey You want the vTiger android application like anCRM vtiger ?
https://play.google.com/store/apps/details?id=com.xirgosoft.vtigercrm
if yes, you have the challenge token you can go ahead with the login. The access key field in the login operation is the md5 checksum of the concatenation of the challenge token and the user's own access key. The login operation, as opposed to getchallenge, is a post request.

How to check username and password in a PostgreSQL server from Android?

I am using the Android 2.2 API. I want to know how to connect to a PostgreSQL database server.
I am new to this and so have no ideas, so please help me with some sample code.

You usually don't connect directly to a database.
To achieve the results you want, you can do a RESTful request.
This means, send either a JSON string or xml file to a server(which you can program in php, ruby and what not)
I'm not going to give you sample code cause there are literally tons of code on a simple google search "android restful login"
Example tutorial
The process is usually:
Enter login credentials on android device -> send post request to server -> validate credentials to the database(postgres in this case) -> send verification back -> android device act upon verification(usually by loading a new activity as a result if logged in successfully)