React-native-keychain: Is it safe to store token as password with blank username.

[chenxsan]

In the begining I stored my token by AsyncStorage, but as I found in https://github.com/facebook/react-native/issues/1032, keychain could be much safer to do it.

So I'm wondering if it's safe to store my token like this:

var server = 'http://facebook.com';
Keychain
  .setInternetCredentials(server, '', token)
  .then(function() {
    console.log('Credentials saved successfully!');
  });

Since the API will only return a token, there's no username here.

[vonovak]

sorry, it's not possible, from the android code:

if (username == null || username.isEmpty() || password == null || password.isEmpty()) {
            Log.e("KeychainModule", "you passed empty or null username/password");
            callback.invoke("KeychainModule: you passed empty or null username/password");
            return;
        }

but seems weird you would only need to store a token, there ought to be somethign the token belongs to. anyways, if not, you can just make up some other string

[chenxsan]

@vonovak Thanks. Might need to reconsider my authenticate policy :).

[NishantDesai1306]

any updates, with storing just a single token ? I am using my web server's Restful API in my mobile app so when user logs in the server sends an access token which I want to store using this lib. Is there any other way to store that right now or do I have to just use some string (probably app name) as username and token as password ?

[Parrryy]

Hey, ideally we don't want to store the username and password combo on the device, but an encrypted token. From what I've seen this library is referenced as the secure solution to store the token but I can't see anywhere on the library of an example of how to do this.

Currently, I'm toying with the idea of using the setGenericPassword with the username and token combination and explaining this in the code comments however it doesn't seem like the best solution. Any thoughts on this? I feel a setAuthToken or something similar may be beneficial with a good example? Has anyone stored an auth token using this library.

[sauhardar]

Agreed here! Any updates on this?