title: Session management for a RESTful Web Service using Jersey
body: <p>I am developing a <a href="http://www.vogella.com/articles/REST/article.html" rel="nofollow noreferrer">Restful Web Service using Jersey</a> between my <code>Android, iPhone</code> apps and MySQL. I also use <code>Hibernate</code> to map the data to the database.</p>
  <p>I have a sessionId (key). it is generated when user Login to the system.</p>
  <p>In <code>User</code> class:</p>
  <pre><code>public Session daoCreateSession() {
      if (session == null) {
          session = new Session(this);
      } else {
          session.daoUpdate();
      }
      return session;
  }
  </code></pre>
  <p>In <code>Session</code> Class:</p>
  <pre><code>Session(User user) {
      this.key = UUID.randomUUID().toString();
      this.user = user;
      this.date = new Date();
  }
  
  void daoUpdate() {
      this.key = UUID.randomUUID().toString();
      this.date = new Date();
  }
  </code></pre>
  <p>When user Sign in to the system successfully, I send this sessionId to the Mobile app client. Then when I want to get some information from database based on the logged in user, I check this <a href="http://jersey.576304.n2.nabble.com/Security-Basic-Session-or-Encrypted-Key-td3490249.html" rel="nofollow noreferrer">Session key</a> as authentication <code>in the REST Services</code> for every request.</p>
  <p>For example for the list of project that user is involved in, I use <code>client.GET(SERVER_ADDRESS/project/get/{SessionID})</code></p>
  <p>insetead of <code>client.GET(SERVER_ADDRESS/project/get/{username})</code>.</p>
  <p>And if it is not a valid session key, I'll send back to the client a 403 forbidden code.
  You can also take a look <a href="https://stackoverflow.com/questions/4973454/session-management-how-to-generate-authentication-token-for-rest-service-je">here</a></p>
  <p>The thing is I am not sure about my approach. what do you think about <code>cons</code> in this approach considering for Jersey and a mobile app?
  I still don't know if the <code>Session key</code> approach is a good idea in my case.</p>