Question: I'm in early (pre-coding) stages of developing a mobile web application using [jQuery Mobile](http://en.wikipedia.org/wiki/JQuery_Mobile) (we looked at [Sencha Touch](http://en.wikipedia.org/wiki/Sencha_Touch) for a few weeks, but jQuery Mobile is a better fit for our team's competencies). I am wrapping the jQuery Mobile web application with [PhoneGap](http://en.wikipedia.org/wiki/PhoneGap) to create an iPhone, iPod touch, and iPad native-ish application. I use Django for our web applications so intend to do the same here for the server-side, with some sort of JSON/Ajax/REST data flow for the interface between the mobile application and the server. Since it's a mobile-only application, we should have access to all the [HTML5](http://en.wikipedia.org/wiki/HTML5) kind of stuff. 

While I am likely to come up with other issues/questions for this implementation, here is my current question/issue:

I need to set up the application so that the first time the user opens the application, they must enter a username and password to authenticate. Subsequently the user should not have to authenticate unless the user clicks a "settings" link which gives them a page to authenticate with a different account or password. The application should still authenticate to the server each time it is started, using the current username and password that was originally entered, to make sure that the account hasn't been disabled or the password changed or something.

I am pretty new to authentication schemes. What should I do?

Answer: 
The KeyChain solution would work only on iOS devices, so if that's your only target you are fine. 

But what about the others? Kind of a waste using PhoneGap but then deploying only to one framework...

I know localStorage is not secure, but if you are aware of the limitations there are ways to make a bit less "obvious".

Here's the [jQuery.handleStorage plugin](https://github.com/jas-/jQuery.handleStorage) which also handles AES encryption... You could have a look at the source and implement only the parts you need (in case you don't want to use the whole plugin, which also supports desktop browsers!).

PS: I am not affiliated in any way to that plugin or the author
Try *[HTTP Authentication with HTML Forms](http://www.peej.co.uk/articles/http-auth-with-html-forms.html)* and see if it helps.