Restlet, GWT and Sessions

Question

What is the best way to have a session between the Java Restlet Java interface and GWT? In my application, the user will log in with a username and password, and if he successfully completes the authentication, the user ID is returned. It is then stored in a cookie and used for API calls. Obviously, this is completely unsafe, because someone can simply change the user ID and start updating and retrieving another user.

Is the best way to also pass the token back with the user id, and API calls should contain that token?

Answer 1

The icon is a good way, and I have seen it in many implementations. This is usually passed as a simple parameter for each request. Following the RESTful idea, you can also just include credentials in the HTTP request each time.