I\'m designing an API for a mobile app, and I hope to keep it RESTful.
API\'s are authorized using Basic HTTP Auth, however, When the user open the app for the first time, h
From wikipedia:
The client–server communication is further constrained by no client context being stored on the server between requests. Each request from any client contains all of the information necessary to service the request, and any session state is held in the client.
Because the server stores no session state from the client, your API shouldn't expose any login/logout capability: In each request you should send user credentials, and the server should validate them each time.
Check this discussion in SO, it claryfies this concept.