This service is divided into two parts: backend (just api with small help of JWE) and frontend (just single page application). I think, JWE is most suited for replacement of browser cookies. It is just encrypted payload, which store some sensitive user information (for example, user_id). And only server can decrypt and read this data (encryption via AES and RSA). So, I think, this solution is very secure and, on the other side, is very easy to use.
- Rails 5.1 will be used;
- JSON API designed just in code, also, this specification sucks=);
- PostgreSQL as database, of course;
- ???
- PROFIT
