SOAP method of authentication

Question

I came across SOAP method of authentication described in the below link: https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_calls_login.htm?search_text=login

Using the sessionId obtained from above call, can be used as an "access token", to potentially access all the secured resources. For now I have just tried to get user profile using it, and was successful. I will further try to use Bulk API.

So wanted to understand if it is an alternate way for OAuth, and what are possible drawbacks of the approach.

Comments/Suggestions/Recommendations?

Answer 1

Yes, you can use a Session Id for all APIs that you have permission to use. For example, you can use the Metadata API only if you have administrative permissions. The Session Id may be used for any of the REST, Bulk, SOAP, Metadata, Streaming, Chatter, or other APIs I haven't mentioned here. There's no real "drawback", except that with a Session Id, you do not get a "refresh token" that you can get from the OAuth login mechanism. This means that if your session expires, you cannot automatically refresh it without logging in again. Other than that, there are no other performance or security implications with using the SOAP login call versus using an OAuth flow.