Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI doesn't grant access to resources accessible via REST and vice-versa? The username and password combinations would be the same.

Afaik if I grant access to both with one login I'd still be able to enforce advanced REST authentication methods, like HMAC, at least when the login comes through REST.

The concrete application is implemented with Java EE techniques, especially Java Server Faces which separates JSF sessions and REST session intentionally or unintentionally, however, it's possible to overcome the separation easily.

1 Answer 1


Keep it separate, or at least don't trust an agent over REST purely based on their holding a cookie.

Allowing a login cookie granted via the web UI to grant access to non-safe http methods in the rest API would create a cross site request forgery (CSRF) vulnerability, unless the rest api includes a defence against CSRF.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.