How to design a RESTful API to check for user's credentials?

Question

I\'m designing an API for a mobile app, and I hope to keep it RESTful.
API\'s are authorized using Basic HTTP Auth, however, When the user open the app for the first time, h

Answer 1

It's typically viewed as poor practice to pass sensitive data via an HTTP GET request.

Password information is sensitive data and is one of the exceptions that breaks the rule that idempotent operations should be GET requests.

Why is this an exception? Browser History and Server Logs will store GET requests. Meaning that this sensitive information is visible as plain text in both places. So if someone gets a hold of either - then that information is now in their hands.

You should use an HTTP POST request to pass this sensitive information to the RESTful API as browsers will not store them and servers will not log them. However, the first line of defense is to use Secure HTTP (HTTPS) to ensure that this information is protected from outsiders.

So pass this information in the body of an HTTP request to an HTTPS URL.