RESTful authentication for web applications [closed]

Answer 1

I know this is a bit of an old question, but I think a lot of the questions here have been addressed in different areas. In particular, I think the OAuth 2.0 Protocol has been considering a lot of these questions; I don't feel authoritative enough to provide a summary of their answers here, but the linked site has a lot of differing use cases called out explicitly, which seems very useful for this question, even if the full OAuth 2.0 isn't really necessary here.

Answer 2

An interesting question. I'm finishing up a REST API implementation right now - having used mod_rewrite and PHP. It uses HTTP basic auth across HTTPS. So far we're working on a Palm Pre client. The guy developing that client was a little put off at having to keep track of user credentials to submit with each request.

The idea of exposing SESSION as a resource is an interesting one. Including it would still violate strict RESTful principles. Even if you expose SESSION as a resource, you'd still be using the server to keep track of client state. Strict adherence to REST would probably require use of cookies, as that's the client-side persistent memory available to you from the browser. Problem is that leaves you to create a JavaScript (or FLash?) client to manage the HTTP requests client-side if you don't want users interacting with the browser-implemented gathering of HTTP credentials.

One tool I've found helpful is the REST Client for Firefox tool... but I still enter my credentials into the standard browser popup even when I'm using that.

I have to admit to including some hacks in my implementation. If all you're doing is using sessions to allow for testing/browsing of the API by potential developers or something I don't think that using session-based authentication is such a big deal. Purists would disagree I'm sure. Really that's what this comes down to... this is essentially an academic argument. In real-life situations you have to do what works.

... adding to this on 10/23/2012 ...

The RESTful methodology insistence on making the client keep track of its own state isn't just academic. It has important implications for scalability and the addressability of the exposed resources. When I say this I assume that by client state we are talking about attributes specific to a requesting user which affect the responses issued by the RESTful interface(s). One of REST's strengths is its addressability. When you make its responses in any way dependent on information not passed in the request you start chipping away at that. Just an afterthought... 3 years later, lol.