One approach I've seen regarding auth is to use a faux-resource: Login: PUT https://example.com/credentials {"username":"foo", "password":"bar"} Chec

One approach I've seen regarding auth is to use a faux-resource: Login: PUT https://example.com/credentials {"username":"foo", "password":"bar"} Check if user is logged in: HEAD http://example.com/credentials Cookie: ... Get current user: GET http://example.com/credentials Cookie: ... Logout: DELETE http://example.com/credentials Cookie: ... From the point of view of the one client, it's no less "real" than any other resource.