title: Session management : How to generate Authentication token for REST service ? (Jersey)
body: <p>I am trying to implement session management in my REST service. I came to know these guidelines while surfing :</p>
  
  <ol>
  <li><p>Not using server side sessions - it violates the RESTful principle.</p></li>
  <li><p>Using HTTP Basic authentication - Not possible right now, as I am asked not to use SSL/TLS (which is no doubt needed for Basic auth.)</p></li>
  <li><p>Using Http digest - I heard this increases network traffic. This sounds costly, especially when my client is a mobile device.</p></li>
  <li><p>Using cookies - I am told I should never rely on cookie for securing my important resources, they can be spoofed easily. Plus, I read about cross-site scripting attacks through cookies.</p></li>
  <li><p>I am left with an option of generating authentication token ,which the user has to send everytime - which I admit is not "entirely" RESTful. </p></li>
  </ol>
  
  <p>Now I need to know, how should I generate these unique authentication tokens, which are secure enough at a business level ? Is there some library for Jersey ? Should I go for OAuth..I have just read a little about them, are they useful in my case ? Please keep in mind that my target clients are mobile devices - can they access an OAuth service ??</p>