为什么在REST API中为app（android端）使用身份验证令牌而不是session_id

Question

in normal php web application after login we use session_id that came from web browser to check if user loged in or not.

But in REST API authentication I read some tutorials that say that php should send back authentication "token" for android app to save it and give it back to php server for every request.

my question is why should I send back some authentication token instead of session_id? I can send back session_id by android app and do normal session stuff on php server side.

ps. if my question is not clear tell then I explain more.

Answer 1

Well, REST API should be stateless, it's one of its defining characteristics. You can use session id, but it wouldn't be REST anymore since you'll be operating a client state on server side.