title: Custom (persistent) session management: Bare minimum
body: <p>I'm designing a custom session management scheme for an Android application. I'm not using any out-of-the-box solution and want it to be as simple as possible. This is the design I have right now, as a sequence of actions:</p>
  
  <ol>
  <li><p>The user sends his login credentials to the server and the server authenticates the user.</p></li>
  <li><p>The server generates a session ID through some mechanism involving cryptographically secure randomly-generated strings, hashing, and possibly timestamps. For the purposes of this question assume it's unguessable.</p></li>
  <li><p>The server adds a new entry in the sessions table corresponding to the session ID generated in step 2. The sessions table has only one column, which is the session ID.</p></li>
  <li><p>The server sends a response. In this response, the server adds a Set-Cookie header whose name is "sessionID" or whatever and whose value is the session ID generated in step 2.</p></li>
  <li><p>The client (i.e. the Android app) stores the received session ID in its SharedPreferences (there are no non-persistent sessions in this scheme).</p></li>
  <li><p>When the user tries to perform an action that requires him to be logged in, the server reads the value of the "sessionID" cookie sent in the client request header and checks if the value of this cookie is in the sessions table. If so, the server allows the action.</p></li>
  </ol>
  
  <p>In addition, all traffic is sent over HTTPS.</p>
  
  <p>Is this everything I need to do? Am I missing anything? In particular, should I store the user ID along with the session ID in the sessions table? I don't see why I would need to, as <a href="https://stackoverflow.com/a/16905531/2024194">this answer</a> seems to suggest, although that answer seems to imply this is only necessary if you have authorization beyond authentication.</p>