How am I supposed to save something like auth cred...

# multiplatform

[Marc]

How am I supposed to save something like auth credentials or JWT tokens in a kmm app?

[Patrick Cavanagh]

Define an expect class and actual implementations per platform that you support which allow you to securely save credentials.

Would suggest using https://developer.android.com/jetpack/androidx/releases/security for Android and the keychain on iOS (various decent libraries out there) to actually save something like a JWT to disk.

[Kirill Zhukov]

multiplatform-settings library has support for encrypted settings https://github.com/russhwolf/multiplatform-settings

[Kirill Zhukov]

uses keychain on iOS, on Android you pass in encrypted shared prefs

[Marc]

So I should store JWT also in sharedprefs or keychain?

[Marc]

And how do I handle smth. like JWT expiration?
Should I just put the validate request into an usecase and pass it down to every viewmodel which needs this authentication, and if JWT is no longer valid just navigate to the splash screen which does the login from sharedprefs/keychain?

[Kirill Zhukov]

Makes sense to store tokens in encrypted prefs and keychain to me.

[Kirill Zhukov]

Expiration and token refreshing is a bit orthogonal to storage problem

[Kirill Zhukov]

One thing you can do is abstract token refreshing behind your service/network client implementation

[Kirill Zhukov]

Ktor Client provides neat Bearer authentication & authorization plugin
https://ktor.io/docs/bearer-client.html#configure

[Kirill Zhukov]

Have you http client handle setting up that plugin and calling to logic for reading access token, refreshing and storing it if needed

[Kirill Zhukov]

And if refresh token is expired, then yeah you would redo login - maybe have your auth plugin return an error and let caller handle it, navigate to the login

[Marc]

The problem is, that the API I have to use has a very weird auth system.
In fact, I don't think its a jwt at all. It's called JSESSIONID and has to be set via cookie header

[Marc]

So I can kinda add this logic to the httpclient directly?
so it checks everytime if token is valid?

[Marc]

I tried storing with the kmm settings repo @Patrick Cavanagh sent here but it does not seem like its storing the credentials encryped tho.
Do I have to use a special implementatino for it? readme does not say anything about it

[Patrick Cavanagh]

I've never used that Multiplatform settings library. Are you passing it an instance of encrypted shared preferences on Android as @Kirill Zhukov suggested?