Ios-php write interface session data problems

Scenario: Use php to write background interfaces for Android and ios (how does an e-commerce platform app handle cookies and sessions on the web? It seems that the interface can also use session,. I asked us about ios. He said that he has never used cookies or other things. orz doesn't know if there is anything more on the app... scenario: Use php to write background interfaces for Android and ios (e-commerce platform apps

What should I do with cookies and sessions on the web?
It seems that the interface can also use session, but =. = I asked us about ios. He said he never used cookies or something like orz.
I don't know if there is a better implementation method on the app.
Why does the app post user data when requesting an interface? Is there any security issues?

Reply content:

Scenario: Use php to write background interfaces for Android and ios (e-commerce platform apps

What should I do with cookies and sessions on the web?
It seems that the interface can also use session, but =. = I asked us about ios. He said he never used cookies or something like orz.
I don't know if there is a better implementation method on the app.
Why does the app post user data when requesting an interface? Is there any security issues?

Use session to maintain logon status:
After logging on to the app (directly verifying the password or logging on to a third party), the server generates a random token string for the user and stores it in the user data table and session. Then, place the app's http request header with the token where the login permission is required, and the server obtains the token in the session for verification. If the token is the same, it indicates the logon status.

Your client may use oauth2.0.

Encrypted user session data is transmitted through post. If the conditions allow https

Http://www.toozy.cn/api-authorization/

The implementation method is the same as that of the browser's cookie mechanism. For example, the client saves the server set-cookie locally, and then adds the previously set cookie to each submission, it is equivalent to the cookie mechanism that Android Developers manually implement in browsers. Session_id is saved in the cookie.

Encrypted Signature transmission: public key transmission and private key encryption