title: How to secure Java webservices with login and session handling
body: <p>I'd like to secure my (Java metro) webservice with a login.</p>
  
  <p>Here's how I'm planning to do that:</p>
  
  <p>Steps required when calling a webservice method are:</p>
  
  <ol>
  <li>call login(user,pwd), receive a session token
  1.1 remember the token</li>
  <li>call servicemethod (token, arg1, arg2...)</li>
  <li>webservice checks if the token is known, if not throw exception otherwise proceed</li>
  <li>logout or timeout after x time periods of inactivity</li>
  </ol>
  
  <p>my questions:
  1. what's your opinion on this approach? does it make sense?
  2. are there any libraries which take the burden of writing a session handling (maybe with database persistence to survive app restarts)</p>
  
  <p>(the solution should be simple and easily usable with Java and .NET clients)</p>
  
  <p>thanks!</p>