title: Security PHP RESTful API
body: <p>I'm starting to develop a simple PHP RESTful API. After reading some tutorials, one of the features about REST is that the </p>
  
  <blockquote>
    <p>"... statelessness is key. Essentially, what this means is that the
    necessary state to handle the request is contained within the request
    itself, whether as part of the URI, query-string parameters, body, or
    headers"</p>
  </blockquote>
  
  <p>Therefore, it means that my PHP server won't need to have $_SESSION ? What kind of approach do you recommend ? Using a token (valid for a short limit of time) in the URL doesn't seem a bit unsecure?
  For example www.myapi.com/1233asdd123/get_user/12.</p>
  
  <p>Many thanks.</p>