title: Spring boot REST token authorization and authentication best practices
body: <p>What is the best practise for authorization and authentication of users in REST spring boot? </p>
  
  <p>I am building web app with standard pages + REST API for mobile. I looked at many articles about Spring security and basically most of them goes with some sort of fitler approach that will allow or block REST calls. In my case, however, I have some auth logic based on who the user is. For example, there is a <code>/update</code> API that updates user  information, and user can update himself, but cannot update other person. 
  Initially I thought to use next auth schema:</p>
  
  <ul>
  <li>User calls auth API and pass name/password or cookie</li>
  <li>System generates short life token, saves in it's database.</li>
  <li>User get this token, updates his cookie (so JS in web application can read and use it)</li>
  <li>When REST call is being make cookies are passed. At Controller, token is extracted, checked for expiration, query is done to database to validate token and get user id.</li>
  <li>Based on user id, REST will be permited or blocked.</li>
  </ul>
  
  <p>Is this the right approach to implement? I have a pretty big mess in my head after reading articles about spring boot security. 
  At least: session auth will not work for me (REST is stateless). I want to make auth for mobile device without storing login/password there.</p>
  
  <p>Does it make sense to pass this token in the REST body itself? What in case of GET method?</p>
  
  <p>Many thanks for sharing your knowledge.</p>