Re: ETag and resource representations

On 14 August 2013 02:11, Hubert A Le Van Gong <[email protected]> wrote:

> **
>
> For instance, if I consider a library (full of books) as a resource. The
> view of that resource (i.e. the list of books returned) may vary based on
> the age of the reader (or any other criteria).
>

This is a different resource from the whole library and should have a
different URI, such as /library/?age=child
If a child went to /library/ and should not be allowed to see some of the
inappropriate books there then either a 401 or 303 should result, not 2xx
response with a subset of the results an adult would see, as that breaks
caching. (You can jump through hoops to make it work, but changing the URI
is better.)

In my own company's system, I have a resource /jobs that represents the
most recent 30 jobs the company has been awarded. The resource /jobs?page=2
represents jobs 31 to 60. We allow our clients to log in to our system, but
when they click the View Jobs link, they don't go to /jobs (and only see
their own jobs) but to /clients/their-name/jobs Attempts to view other
client's jobs URIs result in a 401 (regardless of whether the client exists
or not, so as not to leak data).

Access control coupled with URI proliferation works with the way the web
operates. Changing representation based on viewer works against it.


-- 
Nicholas.