I'm designing a system that will
- Act as proxy calling a service on a back-end in context of user and his session
- Manage sessions for users on multiple back-ends
I will expose the system over HTTP.
Most of the requests will need back-end-id, user-id and session-id parameters, now I can model it as path parameters
Or as HTTP headers (
Where it is better to put those parameters?
For proxy endpoints I definitely not want them in body or query as I want to forward them as is to back-end.
The API will be used server-to-server.
The meaning of session may be something like OAuth authorization. The system manages obtaining and renewing of access credentials and then transparently allows to access back end resources using those credentials.
So example exchange might look like this
- Establish session
barwith back end
- < OAuth exhacnge managed and guided by the system >
- Call service
Aon back end
bazzin the context of user
barand his session
foo(works if the session is established and credentials are valid)
The session identifier is chosen by the client so while all three (session id, user id, session id) are needed to find the session the client does not have to store generated session identifiers so can be stateless.