3 ms·

I believe REST as Fielding defined it has some great benefits. But I'm not a purist. And actually, neither is the person who wrote this post. Because no matter

I believe REST as Fielding defined it has some great benefits. But I'm not a purist. And actually, neither is the person who wrote this post. Because no matter how much the disciples try to wriggle there way around it, using cookies for sessions is not allowed. "We next add a constraint to the client-server interaction: communication must be stateless in nature, as in the client-stateless-server (CSS) style of Section 3.4.3 (Figure 5-3), such that each request from client to server must contain all of the information necessary to understand the request, and cannot take advantage of any stored context on the server.Session state is therefore kept entirely on the client." - from Fieldings dissertation. To be fully compliant you have to do use something like HTTP Basic Auth, where you resend the username and password with each request. I think you should use cookies to store a token that the server can then use to determine whether the "context" of the request is "logged in" or not. I do it. But it's technically a violation.

virmundi 9y ago
I question that idea. Cookie is a standard header. So is Authorization. It's up to the server to require either. Basic auth header removes the need for a handshake to negotiate tokens. Authorization: Bearer (token) is now a standard. I suppose Cookie: (token) could be too, but too many people felt dirty. My point is that Cookie does provide the credentials required for the call contex, this fulfilling the self containment requirement.
- sopooneo 9y ago
  As I read it, the problem is not the mechanism by which a session is maintained, but the very existence of a session at all.
  - virmundi 9y ago
    I know that's what people think. But a JWT in a cookie doesn't strike me as worse than basic auth.
  - virmundi 9y ago
    I know that's what people think. But a JWT in a cookie doesn't strike me as worse than basic auth.
mathw 9y ago
Cookies could be compliant with that, if they contained the entire session state and weren't a key into the session state on the server. They probably shouldn't be used like that, but technically it would be compliant with the requirements you've quoted.

virmundi 9y ago

I question that idea. Cookie is a standard header. So is Authorization. It's up to the server to require either. Basic auth header removes the need for a handshake to negotiate tokens. Authorization: Bearer (token) is now a standard. I suppose Cookie: (token) could be too, but too many people felt dirty. My point is that Cookie does provide the credentials required for the call contex, this fulfilling the self containment requirement.

sopooneo 9y ago
As I read it, the problem is not the mechanism by which a session is maintained, but the very existence of a session at all.
- virmundi 9y ago
  I know that's what people think. But a JWT in a cookie doesn't strike me as worse than basic auth.
- virmundi 9y ago
  I know that's what people think. But a JWT in a cookie doesn't strike me as worse than basic auth.

mathw 9y ago

Cookies could be compliant with that, if they contained the entire session state and weren't a key into the session state on the server. They probably shouldn't be used like that, but technically it would be compliant with the requirements you've quoted.