Re: Authorization and Statelessness

Shea:

<snip>
Why doesn't authorization violate the statelessness constraint of REST?
It seems to reduce visibility (monitoring systems need to know both the
request datum AND the user's access rights to understand a request)
</snip>
you can use the Authorization header to make the auth info visible

server's don't need to "understand" access rights, just apply them. think
about cases where the authentication is done by party A (oAuth), the
authorization list is handled by party B (UMA), and the source material to
access is handled by party C.

<snip>
and scalability (server needs to store access-control metadata across
requests).
</snip>
there is no requirement that servers MUST store AC data across requests. in
fact, i don't to this in my work. maybe an auth proxy does it, however.

</snip>
What makes this different from, say, personalizing a response
based on the client's username?
</snip>


mamund
+1.859.757.1449
skype: mca.amundsen
http://amundsen.com/blog/
http://twitter.com/mamund
https://github.com/mamund
http://www.linkedin.com/in/mikeamundsen



On Mon, Dec 10, 2012 at 3:32 PM, Shea Levy <[email protected]> wrote:

> Hi all,
>
> Why doesn't authorization violate the statelessness constraint of REST?
> It seems to reduce visibility (monitoring systems need to know both the
> request datum AND the user's access rights to understand a request) and
> scalability (server needs to store access-control metadata across
> requests). What makes this different from, say, personalizing a response
> based on the client's username?
>
> Cheers,
> Shea Levy
>
>
> ------------------------------------
>
> Yahoo! Groups Links
>
>
>
>