How to properly store session when developing JSON API?

Question

API

We usually store the session id in the browser's cockie. But let's say I want to use my API in ios / android mobile applications, and I'm going to store a cookie in the application's memory and then insert it into each request from the application. But how right is this? Are there any tips on this?

Answer 1

Authorization by token.
When authenticating, we give the client its token.
He sends it, let's say through the headers: X-Access-Token: bla bla bla
And check on the server.
Of course, do not be too lazy to raise https for such a thing.