title: State-of-the-art session management with OpenID and OAuth2 for web apps
body: <p>I'm implementing an authentication part of my web app using the App Engine (Java), OpenId (for Google signin and so on), and OAuth2 (for Facebook signin). Important requirements include "keep me signed" and secure access for each user to the datastore. </p>
  
  <p>In my understanding, to implement the "keep me signed" feature, I need a cookie to store shared secret generated at server side (App Engine). Also, to secure access to the datastore, each REST API call would need an extra argument, i.e., shared secret, to identify the user each time API is called. Does this sort of session management still dominate development of modern web apps? A more general question is this: is session management outdated in the presence of REST which goes to the direction of stateless? I might misunderstand several important concepts here. Your guidance and pointers to relevant resources are appreciated.</p>