Concerning the inconvenience, it's something that I need to think about once per project and then I move on... if you are creating an API, then it makes sense not to care about Sessions and Cookies, but I do care about request throttling, so it is convenient to have separated middleware groups depending on the application
@tykus Thank you for your advice, and it helps me out to solve the problem also.
but still, I have another problem that when I store session from android application, it does not store any session, unlike accessed through from postman.