RE: the meaning of stateless

On Tuesday, April 23, 2013 11:43 PM, Mike Schinkel wrote:

> I missed this prior to my other two recent emails to the list.
> 
> So the problem with sessions is "implicitness" and not HTTP headers
> because authentication headers are okay, right?

No, it's not their "implicitness" it is because the server has to keep track
of the clients. The server typically creates a small file (or DB entry) in
which he puts session information about the client. You need to replicate
that to all servers if you want to scale such a system.

Authentication headers on the other hand contain all the necessary
information to authenticate a user on every request (think username +
password). It doesn't have to keep any state about the client. The more
servers you add, the more client requests you are able to handle.


> If we ensure all information needed to process an HTTP request is
> explicitly specified in the URL, the content body and/or the headers
> then we are "stateless" with respect to the requirements of REST; is
> that a correct statement?

Yes.. you should also add that a request *must not* depend on a previous
request (the use of a session ID, e.g., does)


Cheers,
Markus


--
Markus Lanthaler
@markuslanthaler