Re: the meaning of stateless

On Apr 23, 2013, at 1:39 PM, Will Hartung <[email protected]> wrote:
> The issue isn't so much the request itself, it's not an issue with cookies per se. It's an issue of misuse on the server. Specifically Sessions.
> 
> It's a problem with hidden conversational state, however manifested (you can represent a Session ID with a query fragment, for example). It goes toward the goal of coarse, self contained transactions being a fundamental core principal of the REST architecture. It's a "spirit of the rule" vs the "letter of the law". As a general rule, you should be able to take requests wholesale, hand them to any server in the system and get the proper result. Making the requests work on first class resources, rather than conversational state discreetly maintained, empowers things like proxies, caching, serendipitous reuse. 
> 
> For example, when you POST to /createquery, perhaps instead of creating a new queryresult, the system realized it already had one that was "current enough" and simply returns the URL to that one. You can easily see something like Google doing that. Internally caching popular queries for a minute.
> 
> But any item typically considered as conversational state can be uplifted to a first class resource (the Transaction pattern being a germane example). The loss of implicit stored server context makes you rethink the problem and bring all of these attributes in to the open, where they can be analyzed more readily, and perhaps repurposed later. Having first class resources means that everything shares the same fundamental properties. Improve the capabilities of these of that foundation, and you potentially uplift the entire infrastructure.

I missed this prior to my other two recent emails to the list.

So the problem with sessions is "implicitness" and not HTTP headers because authentication headers are okay, right?

If we ensure all information needed to process an HTTP request is explicitly specified in the URL, the content body and/or the headers then we are "stateless" with respect to the requirements of REST; is that a correct statement?

-Mike