title: Is this method of authenticating/logging in a user secure?
body: <p>I have a question on the best way to handle keeping a user logged into an app. I'm wondering how to achieve something similar to how apps like Snapchat keep users logged in even when they turn off/on their phone. Am I right in thinking they store an authorization key locally on the device to achieve this? I never want to log a user out unless they hit the "Log Out" button, but I have no experience of using authorization keys to keep people logged in.</p>
  
  <p>So I was wondering if the following method would be a good method to use, or if it's insecure/what would be a better approach to take.
  First, I have a table in my database with the following columns: 
  device_id, username, password, logged_in.</p>
  
  <p>My current method:</p>
  
  <ul>
  <li>When the app boots, get the device's unique ID.</li>
  <li>Send the ID to the database using Javascript/php.</li>
  <li>Use SQL to check the database for the ID.</li>
  <li>If the ID isn't in the database, OR, if the "logged_in" column associated with that ID says "0" (meaning not logged in), then that means it's a new device/and possibly a new user or the user is currently logged out of this device (due to pressing the "Log out" button at the end of the previous session - the "Log out" button changes the "logged_in" column to "0").</li>
  <li>So the app now gives the user the option to enter log in details (username &amp; password), or, sign up for the app (create a username &amp; password).</li>
  <li>If either of these processes is successful, the database gets updated and the user is able to use the app (the "logged_in" column gets changed to "1" - meaning the user is logged in).</li>
  <li>Whenever a user opens up the app, if their ID is in the database, and the associated "logged_in" column = "1", then no log in screen is needed, they're already logged in and have instant access to the app.</li>
  <li>In the case where someone is logged into their account on one device, but then gets a new device, and logs into that one (using their username and password), then their stored device ID gets overwritten by their new device ID. - This should make them appear logged out on their own device (as their old ID won't be found, so they'll be prompted to re-enter their username and password, should they go back to their old phone).</li>
  </ul>
  
  <p>Is this a stable and secure method to verify user details and keep people logged into an app? They'll still have the ability to log out if they want to by pressing the "Log out" button - which will change the "logged_in" column from "1" to "0".  But maybe there's a flaw in this method? I'd really appreciate any advice on the best way to do this. Thanks in advance! </p>