How do I simulate session cookies for RESTful service (Grails, Shiro)? -

i have existing grails application uses nimble plugin (therefore apache shiro security underneath).

i adding restful json api it.

my login method manages session id shiro , returns client:

class apicontroller {     def login(string username, string password) {         def authtoken = new usernamepasswordtoken(username, password)         securityutils.subject.login(authtoken)          render(contenttype:"text/json") {             [                 sessionid: securityutils.subject.getsession().getid()             ]         }     }      def getdata() {         securityutils.subject... // either expect find populated securityutils.subject or way otherwise     } } 

this looks like:

{"sessionid":"61fe89f60f94a4ef7b796783e7a326bc"} 

that quite encouraging, same 1 see being passed in cookie when browser:

cookie:auth=z3vlc3q6dgx1c2lz; m=2663:t|34e2:|47ba:t|4e99:t|6ef2:t|370d:t|3c0d:t|64b8:t|2a03:t|18c3:t|79d4:chart|640c:small|678e:3600%7c60|796a:t; ox_plg=swf|sl|wmp|shk|pm; _ga=ga1.1.441292120.1405856016; __atuvc=0%7c47%2c0%7c48%2c0%7c49%2c432%7c50%2c17%7c51; jsessionid=61fe89f60f94a4ef7b796783e7a326bc 

however, cannot quite figure out how pass jsessionid mobile application in way existing nimble / shiro / grails / servlet (not sure level) authentication filters recognize proper session identifier , associate request session.

i tried manually passing cookie jsessionid=<sessionid> (using dispatch on android) appeared have no effect (although perhaps parameters newvalidcookie aren't correct):

val cookie = com.ning.http.client.cookie.cookie.newvalidcookie("jsessionid", token, null, token, null, -1, -1, false, false) val svc = host / "api" / "getdata" addcookie cookie http(svc ok as.string)  

i tried append ;jsessionid=<sessionid> url , did nothing.

i tried doing new subject.builder().sessionid(sessionid).buildsubject(); in getdata() .sessionid() there didn't string.

i haven't figured out far processing of session cookie takes place.

how assemble session cookie mobile app can use application in same way web client?

p.s. plan b pass username/password in authentication headers upon every request , have apicontroller subject.login every time, i'd prefer rather using session id that's used web application.