[Request] Session support token communication not only using cookie.

[zheeeng]

For some mobile application, it doesn't recognize set-cookie response header and the cookie communication has the CORS risk. I personally prefer using the token as the authentication ticket and the server auth validator check a specific request header, e.g. Authentication, likes the JWT does.

It is better that we can decide to use cookie or token to communicate with clients.

[kataras]

I agree, we have a plan in the roadmap for authentication and verification of API calls. To be honest that was ready for the current release, I've done it and tested it but I had to manage a lot of external products the last months, so it was posponded and removed from the release. Will be here on the upcoming release but this has nothing to do with Sessions. You can already use the current sessions + JWT without any issue, we do it everywhere.

[kataras]

@zheeeng Forgot to mention that you can check the sessions/Config.Encode/Decode of cookie for more security, we have examples as well. There you can implement things like aes.