I want to build a REST API but I have some holes when it comes to the security part. I would like to get my head around how to authenticate the calls to the API.
Therefore, this is my first draft for how the process should be:
- User account is created
- Token is automatically generated and stored in db, associated to that user
- User calls
- Obtains their token as a response Token
- The token is stored in the client side as long as the session lasts
- The token is used to make the rest of the calls
I have to admit I am not fully convinced about the idea of returning the token when
login is called but I need your advice about whether this is a good idea or not. If not, please, give me some advice to approach this situation.