title: Spring Security - REST API - token vs. cookie
body: <p>I have written a REST- API in Java and I have secured this API with Spring Security. The procedure is like this:</p>
  
  <ol>
  <li>Frontend invokes /login RestService in Backend</li>
  <li>Backend gives back token to frontend </li>
  <li>at each REST- API Backend invokation the token has to be placed in header</li>
  </ol>
  
  <p>This works fine, but I have read that it is also possible (with Node.JS/Passport.js/Express.js) that the session object with the cookie inside can be transfered out of the box without any custom code.</p>
  
  <p>My question now would be if there is a better approach so that the frontend/client do not need to set the token into the header all the time for any request.</p>