How is a session ID authenticated in SharedPreferences?

Question

I am learning more about SharedPreferences and would like to understand how exactly everything is working. I have watched a decent amount of videos but I still have some questions.

1. Upon a user logging in, I generate a random session ID using UUID. I then assign the user their session ID and save a session by passing the UserModel into a SessionManagement instance that handles SharedPreferences.

userModel.setSessionId(UUID.randomUUID().toString());

SessionManagement sessionManagement = new SessionManagement(LoginActivity.this);
sessionManagement.saveSession(userModel);

2. When the user closes/opens the app, onStart() is called. It creates another instance of SessionManagement and checks if the session is null using getSession() to determine whether they're logged in or not.

SessionManagement sessionManagement = new SessionManagement(LoginActivity.this);

if (sessionManagement.getSession() != null) {
 // go to some activity
}

And here is what SessionManagement constructor looks like:

private SharedPreferences sharedPreferences;
    private final SharedPreferences.Editor editor;
    private MasterKey masterKey;
    //private String SHARED_PREF_NAME = "session";
    private final String SESSION_KEY = "session_user";
    private final String SESSION_USERNAME = "session_username";

    public SessionManagement(Context context) {
        try {
            masterKey = new MasterKey.Builder(context)
                    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
                    .build();
        } catch (GeneralSecurityException | IOException e) {
            e.printStackTrace();
        }

        try {
            sharedPreferences = EncryptedSharedPreferences.create(
                    context,
                    "secret_shared_prefs",
                    masterKey,
                    EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
                    EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
            );
        } catch (GeneralSecurityException | IOException e) {
            e.printStackTrace();
        }

        //sharedPreferences = context.getSharedPreferences(SHARED_PREF_NAME, Context.MODE_PRIVATE);
        editor = sharedPreferences.edit();
    }

My question now is, if I am just checking whether the session is null or not, how does SharedPreferences know that the sessionID corresponds to the user that initialized it in step 1?

What are the ways that people work around weak/exposed session ID's that a SharedPreferences implementation can protect against?

Is my implementation/flow correct?

Is it safe to save the sessionID to a user model?

I appreciate any help I can get with this topic!

Answer 1

I use SharedPreferences a lot but did not yet use EncryptedSharedPreferences. I think this is only necessary, if you have data that deserves protection in a very strict way (like passwords or similar). But then you might probably want to use Google Identity or similar.

If you use private SharedPreferences, by calling context.getSharedPreferences(.., Context.MODE_PRIVATE) the OS already makes sure your data is only accessable from your app. Unless there is a bug in the system or the device is hacked, no other party has access to your data.

Now to answer your question, what do you use the session ID for?

For me it looks like you try to implement a web application inside an Android app. If this is the case because you are used to build web apps and have no more specific reason, then just forget about session handling and implement the app assuming there is only one user. If you want it because you are communicating with a web service or similar, then let that service do the session handling, if possible. If you really need that session, then the answer to your question is: With your example the system doesn't know the SharedPrefrences you are calling is valid for the current session. The values are always the same, independent on who is currently logged in. What you can do, is to choose a name for your SharedPreferences that corresponds with your logged in user (e.g. the hash of the username/mail address or similar). So you always load the SharedPreferences based on some user identification, just like that: context.getSharedPreferences(username.hashCode(), Context.MODE_PRIVATE)

There are two points to consider, if you do so:

1. You might generate junk data, if a user logs in once, therefore generates a SharedPreferences file, and never logs in again. So it might be appropriate to save the users last activity and clean up from time to time.
2. If you have lot's of users logging in, you might want to consider a database or some other storage type, like json files or whatever, as it's much easier to handle and clean them up.