secure transmission of the credentials

原文

The easiest way for secure transmission of the credentials is to use Https. On successful authentication you'll receive a "cookie" that you can store locally in the user defaults. That cookie will typically expire. So, on subsequent logins, you can check that the cookie hasn't expired, and continue to use it for your server communication.

If the cookie does expire, then you prompt the user to login again, thereby receiving a new cookie from the server.

Storing any user credentials on the device is a big no no. The only way you can do it is to store a hash of the password. You would still need to check a hash of the entered password with the stored hash to check they are equal. It doesn't really give you anything other than a local - no server required - authentication.

Of course don't forget that without having to login again, the app will be vulnerable. Someone else could use the app and the owner's server session would still be active.