Assume there is a request which is going to look up a list of items from a service which requires authorisation (e.g. it's behind a Basic Authentication domain). If the service didn't require authentication, I would always make this request as a GET (it's idempotent). But because the credentials would end up in the query string, I'm basically required to do this as a POST. Is there any alternative to this method?
If you let the browser handle the authentication, it will pop-up a login screen. The results will be included in a request header rather than as query parameters. This login header will be included in every request after the user logs in until the browser is closed.
If you want your own login form, then you will need to POST the id and password to keep them from being query parameters. After the login, you need to use a mechanism to track the login. This is usually done with a session id cookie, although there are mechanisms to include the session id in the URL. With session ids the userid and password only need to be sent once. This is more secure, if you allow the user to access the site using HTTP after login. Consider using a secure cookie for the session id if you want to restrict logged in access to HTTPS.
It really depends. You could for example have a
POST request to query the current time (or the current used memory in the server process, or the number of processed HTTP requests). It has to be a
POST because it is not idempotent, but you might decide to accept such a simple status-querying request even without credentials or authentications.