2

I want to create an endpoint for "logging out". Logging out in my case is basically removing an access token from the database. Therefore DELETE verb makes sense here, something like this: DELETE URL/tokens. Now in terms of rest it makes sense to have URL/tokens/, however it is generally not acceptable to put an access token in the url and rather should be put in the header. Doing the latter, however, would leave the endpoint as URL/tokens only which could imply deleting all the tokens. What do you think?

  • 5
    Just do a POST to a Logout endpoint. You don't need strict REST semantics here, as you're not dealing with an actual resource. – Robert Harvey Jul 29 '19 at 15:49
  • Alright, that makes sense, thanks! – Omar Hossam Ahmed Jul 29 '19 at 15:53
  • 2
    I agree with @RobertHarvey. Something like /users/{user_id}/logout would suffice. – Dan Wilson Jul 29 '19 at 18:18
  • shouldn't you be passing the userId instead of actual token here – Lalit Mehra Jul 30 '19 at 11:14
  • Well, he was asking for REST "abiding" and saying "don't use REST" is not an answer. – Rob Dec 27 '19 at 11:58
0

You are correct that passing sensitive information in URIs is a bad practice from a security perspective. The upshot is that doing so makes it more likely that the information will be exposed e.g. in web logs.

Doing the latter, however, would leave the endpoint as URL/tokens only which could imply deleting all the tokens.

There's some merit to this but I think you are overthinking things a bit. You could change the resource to URL/token (singular) which will make it pretty clear that the specific resource needs to be identified.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.