Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI doesn't grant access to resources accessible via REST and vice-versa? The username and password combinations would be the same.
Afaik if I grant access to both with one login I'd still be able to enforce advanced REST authentication methods, like HMAC, at least when the login comes through REST.
The concrete application is implemented with Java EE techniques, especially Java Server Faces which separates JSF sessions and REST session intentionally or unintentionally, however, it's possible to overcome the separation easily.