Should I separate the REST sessions from the sessions in the rest of the application?

Question

Assuming I have resources I restrict access to with a username + password login in my web application and in my REST API. Should I keep different sessions for both meaning that a login via the web UI doesn't grant access to resources accessible via REST and vice-versa? The username and password combinations would be the same.

Afaik if I grant access to both with one login I'd still be able to enforce advanced REST authentication methods, like HMAC, at least when the login comes through REST.

The concrete application is implemented with Java EE techniques, especially Java Server Faces which separates JSF sessions and REST session intentionally or unintentionally, however, it's possible to overcome the separation easily.

Answer 1

Keep it separate, or at least don't trust an agent over REST purely based on their holding a cookie.

Allowing a login cookie granted via the web UI to grant access to non-safe http methods in the rest API would create a cross site request forgery (CSRF) vulnerability, unless the rest api includes a defence against CSRF.