So, I have a game in Unity for mobiles that gives you the possibility to sign-up with username, email and password to unlock extra features. The datas are sent, through a POST request, to a PHP+MYSQL server that expose an API. I'm developing both so I have complete freedom on how to implement it.
My question is what is the correct way to:
- save auth data on player mobile device so it can automatically login on subsequent runs of the game
- how to safely send username and password to my server for the authentication
I want to protect data from man in the middle attacks and I don't want to send clear password because users tends to always use the same email/password combination.