I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the login succeeded the server returns a randomly generated token the server stores and sends with any https post request it makes. The server verifies the received token is the one generated for that userid. The token has a timeout. Is this procedure secure enough? what weaknesses does it have?
UPDATE the problem is that it seems sessions are not supported by mobile applications (i.e. Android, iOS) and I have had to develop my own kind of sessions. However I am a bit afraid it is not secure enough.