Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>The basic problem you have with that approach is that a url</p> <p>//user:password@site.com/test</p> <p>is equivalent to</p> <p>//site.com/test</p> <p>when you are passing using and password as HTTP Authentication headers</p> <p>Most developers I know wouldn't like to pass user/password on the URL, so they would choose the second option. Now you have an interesting problem, since you have two identical URLs pointing to exactly the same resource, which is contrary to REST, but more importantly, it's contrary to HTTP caching.</p> <p>The moment your users go trough any proxy (and they can't control that, since a lot of proxies can and will be used by organisations and ISPs) you might be serving a cached version of a user to a different user. Not nice.</p> <p>The user and password are NOT really a part of the URL. They are a mechanism most browsers accept for passing http basic AUTH headers, but it's not the URL, so you need to provide unique URIs for unique resources. That is the REST way, and in the case of GET request you should be worried if you don't do it.</p> <p>As an aside, please please please tell me you are going to implement https for this. Passing the user and password on http is a very bad idea. And even if you use HTTPS, encouraging your users to pass the user/pass embedded in the URI means that the user and password is going to be clearly visible on every log of the system (apache/nginx, app server...). That is quite ugly. So I would recommend you to use https and discourage your users from passing AUTH data on the URL. AUTH data should be passed either as a part of a body on a POST request or as a header. </p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload