02. Authentication and session cookies

The login is not a one-time introduction. It is the first verifiable security contract between the client and X-ERP.

The interface as a product

The client sends its credentials to /api/WebApiUser/WebApiLogin. If successful, a cookie container takes over the session cookie; subsequent calls use the same protected session instead of a bearer token.

This makes the connection robust

1. Set up a secure HTTP client with TLS checking, cookie containers, and limited timeouts.
2. POST username and password to the login endpoint.
3. Check status and only accept the cookie in the memory or protected session store.
4. Make a minimal, read-only API call.
5. Handle 401 with limited re-login and stop on repeated failure.
6. Delete session material at end of process or revocation.

Prove production readiness

• Client validates certificate name and trust chain.
• Cookie is only transferred to correct host/path.
• Login errors do not contain passwords in the log.
• Infinite loops with 401 are excluded.

Mistakes that only become expensive during operation

• A cookie is mistaken for an API key and is stored permanently.
• TLS checking will be disabled in production.
• Every request logs in anew and creates unnecessary load.

This is what you take with you

authentication is secure, limited and prepared to expire - not only successful in the Happy Path.

Further information / source

Related topics

1. For integration specialists – connect APIs and external systems › 03. API rights and your own integration user
2. For integration specialists – connecting APIs and external systems › 09. Error diagnosis, logging and restart

Frequently asked questions