You are correct that your scenario is not workable.
To create a session, you must POST to user/session with a POST payload that includes the user's email and password
↧
Can a session token be generated in pure HTTP?
↧