My application is divised into two parts:
- Server side API's (RESTFUL through Play!2.2 framework)
Once authenticated, users could call my various own apis, like POST /product etc...
Currently, I make use of a cookie-based token mechanism, implementing by this great plugin: SecureSocial.
Isn't a cookie anti RESTFULness? Perhaps not in this case, since I just store the access token... to be sent at each API call, like any other API KEY system would do, wouldn't it?
However, it forces me to use a persistence store (like memcached) to store the current cookie values corresponding to current connected users.
On the client side, each user store this cookie: "id: 12989348797024974..." (being a token sample based on many bits)
Should I stay with this cookie-based token that works great although the use of memcache (or other cache) or should I alter this strategy or even focused to another?