title: How to keep persistant login session for rest API using WebAPI
body: <p>I need to be able to provide a persistent logged in session for a Mobile App communicating with a ASP.NET WebAPI REST service.</p>
  
  <p>Currently, the connection is over SSL and the user credentials are passed to WebAPI for authentication.  The server then responds with an Api token which is used for the duration of the session.</p>
  
  <p>This all works ok, but I need to provide the ability for the user to be able to click a 'Keep me logged in' checkbox on the login screen.</p>
  
  <p>My initial thoughts were to simply store the Api key in local storage and when returning to the site, lookup the Api key in the local storage and resume comms with the server. Only on logging out, or unchecking the 'keep me logged in' checkbox would clear this out.</p>
  
  <p>How secure is this?  What is the recommended way of achieving this kind of system?</p>