Java – restlet, GWT and sessions

What is the best way to establish a session between restlet Java API and GWT? In my application, the user will log in with user name and password, and return userid if successful authentication It is then stored in a cookie and used for calls to the API This is obviously completely unsafe because someone may just change the user ID and start updating and retrieving another user

Is it also the best way to use userid callback token, which must be included in the API call?

Solution

Token is a good way, and I have seen it in many implementations Typically, this is handed over as a simple parameter for each request Following the restful idea, you can also include credentials in each HTTP request