I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea:
- User try to login using a form in POST method.
- Login success
- Server generate an unique session ID string and send it to the client, than create an Hashmap with KEY = session ID and value = User object.
- Client store the unique session ID, Username and Password using HTML 5 localStorage.
- On each request, client send the SessionID, username and password and the server checks if everything matches.
So, here's my question: Is this method safe?