I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the caller.
The api is only available though SSL 3.0 or TLS 1.0.
What are the main attacks which would be possible in this scenario?
The answer and comments to this SO question seem to indicate that if the risk of attack is proportionally low, more complexity will not improve security but will add complexity. I would like to know the highest risk areas for attack to determine the appropriate counter-measures, if necessary.