Session Management for a RESTful Web Service Using Jersey

Question

I am developing a Restful Web Service using a jersey between my Android, iPhone and MySQL applications. I also use Hibernate to map data to a database.

I have sessionId (key). it is created when a user logs in.

In the User class:

 public Session daoCreateSession() { if (session == null) { session = new Session(this); } else { session.daoUpdate(); } return session; } 

In the Session Class:

 Session(User user) { this.key = UUID.randomUUID().toString(); this.user = user; this.date = new Date(); } void daoUpdate() { this.key = UUID.randomUUID().toString(); this.date = new Date(); } 

When the user login successfully, I send this sessionId to the client of the mobile application. Then, when I want to get some information from the database based on the registered user, I check this Session key as authentication in the REST Services for each request.

For example, for the list of the project in which the user participates, I use client.GET(SERVER_ADDRESS/project/get/{SessionID})

insert client.GET(SERVER_ADDRESS/project/get/{username}) .

And if this is not a valid session key, I will return the forbidden code to the 403 client. You can also look here.

The fact is that I'm not sure about my approach. what do you think of cons in this approach when considering for a jersey and mobile app?

I researched Spring Security . I still don't know if I can use it instead if the Session key approach is not suitable. Can you help me?

Answer 1

If you want to use SessionId then it should have validation time, for example:

 private static final int MINUTES = 90; public boolean isValid() { return System.currentTimeMillis() - date.getTime() < 1000 * 60 * MINUTES; } 

I also suggest you take a look at security and session management in Jersey .

Check out these links for Spring Security : Spring Security with Jersey and the Spring Security Application Example .

Take a look at Jersey Remains API Protection .

Answer 2

This is a solvable problem: servlet containers, such as Tomcat, already do session management and can distribute session state to other containers in the cluster, either by broadcast over TCP or using a shared data source, such as memcache.

I suggest reading what is already available, and not inadvertently reinventing the wheel. In addition, it will become an incredibly hot table if your application is popular. How do you clear old session identifiers?