Hur fungerar ett säkert login på en mobil applikation?

public void whenSettingCookiesOnTheHttpClient_thenCookieSentCorrectly() 
  throws ClientProtocolException, IOException {
    BasicCookieStore cookieStore = new BasicCookieStore();
    BasicClientCookie cookie = new BasicClientCookie("JSESSIONID", "1234");
    cookie.setDomain(".github.com");
    cookie.setPath("/");
    cookieStore.addCookie(cookie);
    HttpClient client = HttpClientBuilder.create().setDefaultCookieStore(cookieStore).build();
 
    final HttpGet request = new HttpGet("http://www.github.com");
 
    response = client.execute(request);
    assertThat(response.getStatusLine().getStatusCode(), equalTo(200));
}

CredentialsProvider provider = new BasicCredentialsProvider();
UsernamePasswordCredentials credentials
 = new UsernamePasswordCredentials("user1", "user1Pass");
provider.setCredentials(AuthScope.ANY, credentials);
  
HttpClient client = HttpClientBuilder.create()
  .setDefaultCredentialsProvider(provider)
  .build();
 
HttpResponse response = client.execute(
  new HttpGet(URL_SECURED_BY_BASIC_AUTHENTICATION));
int statusCode = response.getStatusLine()
  .getStatusCode();
  
assertThat(statusCode, equalTo(HttpStatus.SC_OK));

public HTTPMessage login(String username, String password) {
		// Basic Auth
		CredentialsProvider credsProvider = new BasicCredentialsProvider();
		credsProvider.setCredentials(new AuthScope(ADDRESS, PORT), new UsernamePasswordCredentials(username, password));
		
		// Cookie
		BasicCookieStore cookieStore = new BasicCookieStore();
	    BasicClientCookie cookie = new BasicClientCookie(username, password);
	    cookie.setDomain("." + ADDRESS + ":" + PORT);
	    cookie.setPath("/");
	    cookieStore.addCookie(cookie);
	    
		httpclient = HttpClientBuilder.create().setDefaultCookieStore(cookieStore).setDefaultCredentialsProvider(credsProvider).build();
		
		return sendPost(LOGIN_URL + "?username=" + username);
	}

	/**
	 * Send a url command and get HTTPMessage object
	 * @param url String of our url
	 * @return HTTPMessage
	 */
	public HTTPMessage sendPost(String url) {
		try {
			// Get the response
			HttpPost httppost = new HttpPost(url);
			CloseableHttpResponse response = httpclient.execute(httppost);

			// Get the HTTPMessage object
			String json = EntityUtils.toString(response.getEntity());
			Type type = new TypeToken<List<HTTPMessage>>() {}.getType();
			HTTPMessage hTTPMessage = new Gson().fromJson(json, type);
			hTTPMessage.setConnectionStatus(response.getStatusLine().getStatusCode());

			// Return the object
			return hTTPMessage;
		} catch (IOException e) {
			return null;
		}

	}

private CloseableHttpClient httpclient;
	
	/**
	 * Login
	 * @param address
	 * @param port
	 * @param username
	 * @param password
	 * @return 
	 */
	public HTTPMessage login(String username, String password) {
		// Basic Auth
		CredentialsProvider credsProvider = new BasicCredentialsProvider();
		credsProvider.setCredentials(new AuthScope(ADDRESS, PORT), new UsernamePasswordCredentials(username, password));
		httpclient = HttpClientBuilder.create().setDefaultCredentialsProvider(credsProvider).build();
		
		// Try to login
		HTTPMessage hTTPMessage = sendPost(LOGIN_URL);
		
		// Check connection status
		if(hTTPMessage.getConnectionStatus() == HttpStatus.SC_OK) {
			// Save cache
			HttpHost targetHost = new HttpHost(ADDRESS, PORT, "http");
			AuthCache authCache = new BasicAuthCache();
			authCache.put(targetHost, new BasicScheme());

			// Add AuthCache to the execution context
			HttpClientContext context = HttpClientContext.create();
			context.setCredentialsProvider(credsProvider);
			context.setAuthCache(authCache);
		}
		
		return hTTPMessage;
	}
	
	/**
	 * Login with cache
	 */
	public void loginWithCache() {
		httpclient = HttpClientBuilder.create().build();
		HttpGet httpget = new HttpGet(LOGIN_URL);
		CloseableHttpResponse response = httpclient.execute(httpget, context);

	}