title: How would a user stay logged in to a REST-based website?
body: <p>A year or so ago I asked this question: <a href="https://stackoverflow.com/questions/544474/can-you-help-me-understand-this-common-rest-mistakes-sessions-are-irrelevant">Can you help me understand this? “Common REST Mistakes: Sessions are irrelevant”</a>. My question was essentially this:</p>
  
  <blockquote>
    <p>Okay, I get that HTTP authentication is done automatically on every message - but how? Is the username/password sent with every request? Doesn't that just increase attack surface area? I feel like I'm missing part of the puzzle.</p>
  </blockquote>
  
  <p>The answers I received made perfect sense in the context of a mobile (iPhone, Android, WP7) app - when talking to a REST service, the app would just send user credentials along with each request. That worked great for me.</p>
  
  <p>But now, I would like to better understand how one would secure a REST-like website, like StackOverflow itself or something like Reddit. How would things work if it was a user logged in via a web browser instead of logged in via an iPhone app?</p>
  
  <ul>
  <li>What happens when a user logs in? Are the credentials saved in the browser somehow?</li>
  <li>How would the browser know what credentials to send with subsequent REST requests?</li>
  <li>What if it's a JavaScript call to a webservice? How would the JavaScript call include user credentials?</li>
  </ul>
  
  <p>I'll be quite frank: my understanding of security when it comes to websites is pretty limited, I'm not a web developer (Damnit Jim, I'm a desktop developer!). I enjoyed working with REST services from an app perspective, but now I want to try and build a website that is based on REST principles, and I'm finding myself to be pretty lost.</p>
  
  <p>If there is anything in the above question that is unclear that you'd like me to clarify, please leave a comment and I'll address it.</p>