Q:

REST server user authentication

So i am creating my first larger scale application (by larger scale i mean something i see myself publishing in the app store) and i am not sure of how to handle user authorization.
The client will consist of a application for android and iphone, and they make HTTP requests on a server.
My data is stored in a postgreSQL server and i have already implemented so that a user can log in, but right now logging in basically means nothing. When you query the database there is no check to make sure that the data you request / wish to alter is yours. 
I was thinking that when a user log in they receive a token. Whenever a request would be made upon a user ID, the host requesting this data would also have to provide that IDs token.
Queries are made with rest calls, and are usually of the form [id of user, new data 1, new data 2, new data 3], and this new data will be inserted into a table, and the new row will have a relation to the client id.
The data i store is in no way sensitive. Most requests will be a user wishing to add a row to a table in my database. The most sensitive piece of information would probably be a users email, so this authentication system would only be in place to ensure that no one is inserting troll-data on a client that is not them.
Another point i'm not sure how to handle is what to do when the token expire. I cannot request the user to log in every few hours, the token should be renewed automatically. Is it normal to store id / pass at the client and do the request automatically?

A:

First off, the token approach seems sound for your case.  One option is to encrypt user information (e.g. id) into the token.  On the server side, you can then keep things stateless.  Realize that no matter the details of how it is generated, this token is sensitive.  If someone has it, they can use it to pretend to be that user as long as it is valid (just like a session id.)
To the last part, it's unclear what the log in requirement is here.  You say you don't want them to have to log in every few hours.  How often do you want them to have to log in and is that based on inactivity?  I would not recommend storing the credentials as other applications on the device could potentially retrieve the credentials.

