1

I have created a REST API for an android application. There are certain req.session variables that I set at certain points and use them in the policies for further steps. Everything works fine when I access the API from a REST client like POSTMAN.

However, when it is accessed from a native android app, the req.session values that I set in one step are lost in the next step.

Any idea why this might be happening and what might be the workaround ?

Mandeep Singh
  • 7,674
  • 19
  • 62
  • 104

1 Answers1

2

Session does not work with request sent from untrusted client (in this case the Android device).

You should consider using the OAuth strategy to accomplish your target. It's a bit complicated.

Or just simply generate an accessToken for each successful login then return it to the client. For further requests, the client must attach this accessToken (usually to the header) of the requests.

This is a good SO question for the same issue: How to implement a secure REST API with node.js

Community
  • 1
  • 1
haotang
  • 5,520
  • 35
  • 46