android - How to use security (Authentication & Authorization) in ASP.NET Web Api -

i developing android application use sql server(database) store application's data. in addition, application use asp web api send , receive xml or json between client , server.

i confused how make application authentication securely , how keep user logged in without need keep sending user's credentials in http requests.

therefore, need recommendation how secure application , provide me tutorial links if possible.

1. login (username, password shored in basicnamevaluepair) client (here android) access web api controller (perhaps /token if use samples asp.net web api website). if success, access token responsed , save in client (sharedpreference or database)
2. then, need send access token (no need username, password anymore) request other api controllers.

of course, https should used here better security.

sample codes getting access token (login phase):

public static object getaccesstoken(string address, string grant_type, string username, string password) throws exception {     list<namevaluepair> params = new arraylist<>();     params.add(new basicnamevaluepair("grant_type", grant_type));     params.add(new basicnamevaluepair("username", username));     params.add(new basicnamevaluepair("password", password));      // making http request     httpresponse = makehttprequest(address, params);     if (httpresponse != null) {         statuscode = httpresponse.getstatusline().getstatuscode();         if (statuscode != httpstatus.sc_ok && statuscode != httpstatus.sc_bad_request) {             return httpresponse.getstatusline().tostring();         }          // json string (jsonstring) input stream (is)         getjsonfrominputstream();         if (jsonstring.isempty()) {             return null;         }         // parse json string json object         jobj = new jsonobject(jsonstring);     }     // return json object     return jobj; } 

inside makehttprequest, request access token:

httppost.setheader("content-type", "application/x-www-form-urlencoded"); httppost.setentity(new urlencodedformentity(parameters));