4 ms·

S3 uses a request signing mechanism. Each request is signed by the client and the signature is sent in the headers. Rackspace Cloud Files uses a token based au

S3 uses a request signing mechanism. Each request is signed by the client and the signature is sent in the headers. Rackspace Cloud Files uses a token based authorization. Authentication provides a token that is then sent in the header of each request. When the token expires, re-authenticate to get a new token. The Cloud Files method is a little simpler for the user (IMO), but it also requires an SSL connection to protect the credentials. Neither of these products allow non-public objects to be viewed in a browser (the browser doesn't send the correct headers).

mojuba 17y ago
Something like the HTTP digest authentication but non-standard, right? I think it's still possible to have the server accept the token as a URL parameter if it's in some special debug mode. Obviously the debug mode should be implemented with great caution. Or challenges/digests can be sent back and forth as part of data rather than in the headers. This way I can debug the REST server using HTML forms.
- notmyname 17y ago
  In my opinion, browsers aren't a good way to test a REST interface. Browsers are good at GET, and maybe POST, but they are very limited for other HTTP verbs and can't really do much in the way of header manipulation. A much better solution is to use a tool like curl. With curl, you can set headers, HTTP verbs (even custom ones), and, importantly, test each transaction in isolation.