Session management in a Service Oriented Architecture

Question

Where should you manage a users session in a SOA? Should you manage it in the Web Service or in the client and why?

My application is SPA (Considering that this will be the stacked that will be used Apache CXF for Web Services AngularJS for making REST calls)

Answer 1

I think session should be managed of Client side as far as possible in SPAs.In SOA , Mostly service are viewed as stateless and puting state logic inside it will be deviation. Servies ae meant to perform the task without botherig about sessions. However maintaing session on client side increasese the complexity a lot.

• kravemir: Well. If service exposes some REST API, then it should be able to somehow distinguish users and perform authorization...
• Ben Cheng: How can the app store the session data. By Database?
• sapan: One way to maintaining session at client side could be browser storage(browser's local storage or session storage) which are urls based.

Answer 2

Session should be managed at client side, as services mainly for server side processing and not for maintaining user session. But if we are managing user session at client side we need take care of security pitfall at client side, as user data is prone to get changed.