Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

5
  • @arunasr but what's the different of session token and username/pwd? they're all a unique id for a user Commented Jul 8, 2015 at 14:35
  • 2
    @Shawn username/pwd is authentication credentials for a user. Session token is one-time expirable random data. Why you need a token when you can send user name/pwd every time? So that you don't have to store and transmit user credentials many times. User name and password are sensitive and should be protected by expensive hashing algorithms. You want to store and transmit them as little as possible, in case a third party gets hold of them. A session token is temporary and does not compromise security permanently even if intercepted. Commented Jul 20, 2015 at 11:12
  • Upvoted since it explains a simple way for this to work without utilizing some huge and impenetrable 3rd party solution. As such, it allows people to understand what's going on behind the scenes. But I also have a question: isn't this mechanism essentially what you would do if you were to implement authentication for a GUI (presentation oriented) web application? So essentially you can use the same mechanism to secure both service-oriented (REST) and presentation-oriented (e.g. JSF) web applications? Commented Nov 23, 2016 at 22:36
  • Also, this requires a back-end database for the REST application to keep the session tokens on the server-side, right? Or I guess they can be kept in the memory (e.g. in the servlet context using setAttribute) as well if the volume is low? Commented Nov 23, 2016 at 22:41
  • Yes, you'd need to keep the session information somewhere accessible to all load-sharing servers, can keep in-memory if you don't want sessions to survive server restart and load-share. I don't think memory is a consideration, unless your sessions are extremely long. Commented Nov 30, 2016 at 23:59