Hacker News Reader

Comment by JimmyL | Hacker News Reader

>> You have an “API/Key/Token” in a header or a url.

This - specifically, how to do user authentication/access control in a RESTful manner - has always puzzled me. The author suggests HTTP Digest authentication, but that seems to fly in the face Roy Fielding's commandment that a RESTful interface shouldn't depend on the communications protocol being used; HTTP Digest seems pretty tightly coupled to HTTP, no?

Broadly, what are some of the canonical ways to do user authentication while still keeping close to the theoretical/theological underpinnings of REST?

View on HN

RESTful interfaces should NOT be ptotocol independent. While REST can be implemented over multiple protocols, a RESTful interface is by definition tightly coupled to the protocol it goes through. For instance REST specifies that we should use a uniform interface, but HTTP tells us what that interface is, and a REST over HTTP interface (the most common RESTful interface) has to respect that. I would be interested in where you read this fielding quote as this 'protocol inependence' and its problems is a common charge he makes agains WS-* if anything.

http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hyperte...

Specifically:

A REST API should not be dependent on any single communication protocol, though its successful mapping to a given protocol may be dependent on the availability of metadata, choice of methods, etc. In general, any protocol element that uses a URI for identification must allow any URI scheme to be used for the sake of that identification. [Failure here implies that identification is not separated from interaction.]

Well, Roy has a way of describing things from a Systems Engineering perspective. that can confuse when read from people with a different context. I think where HTTP digest etc. comes in is the 'successful mapping' bit. While the abstract API should not specify HTTP digest, the materialised API that people actually use (the mapping of the API onto HTTP) should.

This is an interesting blog post on http authentication woes:

http://www.artima.com/weblogs/viewpost.jsp?thread=155252

Every single one of these concerns can be solved wuth digest auth over javascript: http://www.peej.co.uk/articles/http-auth-with-html-forms.htm... and http://www.berenddeboer.net/rest/authentication.html

Amazon has clients sign the request: http://docs.amazonwebservices.com/AmazonS3/2006-03-01/RESTAu...

Reply on news.ycombinator.com