1

I want to create an endpoint for "logging out". Logging out in my case is basically removing an access token from the database. Therefore DELETE verb makes sense here, something like this: DELETE URL/tokens. Now in terms of rest it makes sense to have URL/tokens/, however it is generally not acceptable to put an access token in the url and rather should be put in the header. Doing the latter, however, would leave the endpoint as URL/tokens only which could imply deleting all the tokens. What do you think?

  • 4
    Just do a POST to a Logout endpoint. You don't need strict REST semantics here, as you're not dealing with an actual resource. – Robert Harvey Jul 29 at 15:49
  • Alright, that makes sense, thanks! – Omar Hossam Ahmed Jul 29 at 15:53
  • 2
    I agree with @RobertHarvey. Something like /users/{user_id}/logout would suffice. – Dan Wilson Jul 29 at 18:18
  • shouldn't you be passing the userId instead of actual token here – Lalit Mehra Jul 30 at 11:14
0

You are correct that passing sensitive information in URIs is a bad practice from a security perspective. The upshot is that doing so makes it more likely that the information will be exposed e.g. in web logs.

Doing the latter, however, would leave the endpoint as URL/tokens only which could imply deleting all the tokens.

There's some merit to this but I think you are overthinking things a bit. You could change the resource to URL/token (singular) which will make it pretty clear that the specific resource needs to be identified.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.