Services 3 Session authentication CSRF Validation with Persistent Log in I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated forever. Is it possible? 

Here is the workflow i am following.  

First launch of app


POST /services/session/token to retrieve CSRF Token
POST myendpoint/system/connect with X-CSRF-Token header
IF not Logged In Try Log in /myendpoint/user/login
Log in Success and keep session_name=sessionid in Cookie Varible


Future Launches


POST /services/session/token to retrieve CSRF Token
POST myendpoint/system/connect with X-CSRF-Token header along with previousely saved session_name=sessionid as Cookie Header


From this point I am getting ["CSRF validation failed"] message. Am I missing something? Is the workflow correct?
Evidently the workflow has been simplified.  I make a single call to /user/login.  Here is an example:

{
  "method": "POST",
  "url": "http://HOSTNAME/SERVICE_PATH/user/login",
  "headers": {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Connection": "keep-alive"
  },
  "json": {
    "username": "USERNAME",
    "password": "PASSWORD"
  }
}


which returns:

Response: {
  "sessid": "waroHcB4h8rbU0yhZjh-zGLAquZYlpayC_kB38gx--I",
  "session_name": "SESSb4d5ba755bb4eb727d982993490e6681",
  "token": "MHT4hmagxHgf0lOYlkENGlTZGk2AZ96G3p3ZCCc2kvo",
...
}


Now the cookie is created by concating the session_name and sessid with the equal sign separating them.  The X-CSRF-Token header is simply the token in the response.  All future requests will reuse the X-CSRF-Token: and Cookie: headers:

Here is an example of a user profile request:

{
  "method": "POST",
  "url": "http://http://HOSTNAME/SERVICE_PATH/user/profile",
  "headers": {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Connection": "keep-alive",
    "X-CSRF-Token": "MHT4hmagxHgf0lOYlkENGlTZGk2AZ96G3p3ZCCc2kvo",
    "Cookie": "SESSb4d5ba755bb4eb727d982993490e6681=waroHcB4h8rbU0yhZjh-zGLAquZYlpayC_kB38gx--I"
  }
}


Short answer: call /user/login once, set and reuse the X-CSRF-Token: and Cookie: headers for all future REST calls.