I want to create a new session, the new session will be created by logging in (naturally).

Should I pass the username and password:

  • via URL (POST request to session?username=:username&password=:password)
  • or should I use a header instead (for instance - Authorization?)?

I want to stress that the session is not existent, I want to create it.

  • 1
    Are you using a session to store persistent state information, or just for authentication? I think it's a good idea to avoid the notion of "sessions" in a restful API, and just pass authentication parameters by header. – Matthew Sep 25 '15 at 14:17
  • @Matthew: So I should pass username and password to the server every time I make a request? I was actually thinking about obtaining a session token from the server when logging in, which would be passed every time a request was made. Is this a bad approach? If yes, why? – sjaustirni Sep 25 '15 at 14:22
  • It's bad because it makes it more difficult for the client (they must make an extra call and save state [the token] on their end), and you have to deal with session expiry scenarios on both ends. Stateless restful services are easier to test and understand. I would just pass the authentication information on every call. I do it through headers, I tend to use "basic http authentication", it's a very simple mechanism. – Matthew Sep 25 '15 at 14:37
  • @Matthew : Thank you. So here's the deal :) : You write it as an answer and I accept it. What do you say? :) – sjaustirni Sep 25 '15 at 14:43
  • 2
    @Matthew: You got your money! Enjoy! And once again - thanks for giving me the right direction. – sjaustirni Sep 25 '15 at 15:04

I recommend keeping your RESTful interface stateless. This means for every request, you must pass in all authentication information. I have used Basic Authentication (credential in HTTP headers) with great success.

Keeping your RESTful interface stateless greatly simplifies your server logic and your client's logic. Every request is autonomous, and you do not have a temporal coupling on your authentication mechanism. It makes your application easier to test, and you will not run into scenarios where the session expires and the client doesn't expect it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.