This service is not well designed according to the REST principle. You have a resource named User where you call action on it (login and logout). A better approach is to create a SessionResource and use a post request for the login (because you create a session) and a DELETE request for the logout (because you delete the current session of the user)