The basket should be processed as a resource, and products added / removed in the same way as you can add or remove associations between any two resources in REST. Instead of the customer saying, “Now buy items in my basket,” the customer should say, “Now buy goods in basket # 187462.” Assign a URL to each basket, and your actions will act on this resource, and not on any product array tied to the current session.
An alternative, which is also stateless, is that the client tracks all the items in the basket, but this means that the user cannot leave the basket (refuse it) on one computer and resume purchases on another device.
Addendum: Remember that authority / access control can be assigned independently. Of course, each cart has a URL, but make sure that the registered user can see only the cart resources they created.
source share