Hi All,
After a user gets authenticated, what do you recommend to handle the concept
of a session without breaking the RESTful paradigm?
It seems like all post-login requests to the server needs to include some
kind of nonce or token to identify the "session" so to speak.
If that's so, the server needs to understand and store that token to
validate it for every incoming request.
Wouldn't that break the RESTful paradigm since the server is now storing
application state?
--
Arthur Y.