Enhance User Authentication in Loyalty Hair App
Publicada el 2026-07-29
Descripción de la oferta
Technical Analysis: Device Binding Authentication for Loyalty Hair Application (Android / IOS) 1. Overview This document outlines the technical requirements and implementation logic for securing user authentication in the Loyalty Hair application by binding a user's account to a specific device ID. This mechanism prevents unauthorized logins from multiple devices using the same credentials. 2. Database Schema Modifications To support device binding, the user table/collection must include a field to store the unique device identifier. New Field Name: device_id (String / Nullable) Description: Stores the unique identifier of the device currently authorized to access the user account. It can be NULL (or empty) when the user is logged out or has never logged in from a tracked device. 3. Core Logic & User Flows A. Registration Flow (/register) During the registration process, the application must capture both the standard user details (including the phone number) and the current device's unique identifier. The user submits their registration details along with their phone number. The client app generates or retrieves the device's unique ID (device_id). The backend stores the user profile in the database, setting the device_id field to the provided device identifier. B. Login Flow (/login) The login process enforces strict validation based on the combination of the phone number and the device_id. [User Attempts Login] │ ▼ [Check if device_id in DB is NULL/Empty?] ├── YES ──► [Allow Login & Update DB with Current device_id] (First-time or post-logout) │ └── NO ───► [Match Submitted device_id with DB device_id?] ├── MATCH ──► [Allow Login] └── MISMATCH ─► [Deny Login: Device Unauthorized] Detailed Login Rules: Empty/Null device_id in Database: If the user's record in the database has a NULL or empty device_id (e.g., after a logout), the system allows the login using only the phone number. Upon successful authentication, the database updates the user's record with the current device's device_id. Existing device_id in Database: If the database already contains a stored device_id for that phone number, the system compares it with the incoming device's ID. Match: Login is successful. Mismatch: Login is rejected with an error message (e.g., "This account is already linked to another device"). C. Logout Flow (/logout) When a user explicitly logs out of the application, their session data and device binding must be cleared to allow future logins from either the same or a new device. The user triggers the logout action. The backend updates the user's record, setting the device_id field to NULL (or empty). The client clears local session tokens and storage. Result: The next time the user attempts to log in, the device_id in the database will be empty, allowing them to bind the account to the new (or current) device seamlessly. The application already exists in flutter and an addition is needed
Skills
Fuente original: freelancer