Create session for java login REST service. -

i trying set session management on simple login service have written using jax-rs. code might not good:

@path("/login") public class login {      @get     @path("/{id}/{pass}")     @produces(mediatype.application_json)     public hashmap<string, boolean> isuservalid(@pathparam("id") string id, @pathparam("pass") string pass) {      // retrieve user map database     databasecontroller db = new databasecontroller();     hashmap<string, boolean> validation = new hashmap<string, boolean>();     validation.put("isvalid", false);      (map.entry<string, string> user : db.user().entryset()) {         if ( id.equals(user.getkey()) && pass.equals(user.getvalue())) {             validation.put("isvalid", true);         }     }     return validation; } 

does know how can set session management on service.

rest web services meant stateless , if want statefull service use soap , there dirty hack around not secure use authentication token along every request of rest , keep client states browser , ip etc. in database along token u know change in client or attack.