Question

I am creating an ‘API as a service’ by developing a separate REST API server and a web-app server which simply serves up a website that consumes the REST API. The web-app acts as a client of the API. The web-app is a simple dashboard that allows a user to login and see their API usage and view their API secret and keys so that they can access the API securely.

I am planning on using AWS-like shared secret to enable clients of the API to access protected resources.

But one thing im confused about is when the user logs in to the dashboard website, should this be handled by the REST API, or by the web-app server.

If it is to be handled by a REST API endpoint, how does the API server maintain session state between requests. How does the API know if the user is logged in or not? Is it ok to store session state on the API server, even though it is supposed to be stateless. How do other rest-like API’s like twitter do this?

Answer 1

ReSTful security is handled server-side; basically:

• the server returns a 401 status code when a client ask for a resource without been authenticated
• every client call have to provide authentication through a WWW-Authenticate header
• this header can be store client-side in a cookie after a successful login

You will find great help on the matter in the book: ReSTful WebServices Cookbook. Look for explaination on basic / digest authentication.

Here is a good introduction with a live working sample.