title: REST and authentication variants
body: <p>I am currently working on a REST library for .net, and I would like to hear some opinions about an open point I have:  REST and authentication.</p>
  
  <p>Here is an example of an RESTful interface used with the library:</p>
  
  <pre><code>[RestRoot("/user")]
  public interface IUserInterface
  {
    [RestPut("/")]
    void Add(User user);
  
    [RestGet("/")]
    int[] List();
  
    [RestGet("/get/{id}")]
    User Get(int id);
  
    [RestDelete("/delete/{id}")]
    void Delete(int id);
  }
  </code></pre>
  
  <p>The server code then just implements the interface and the clients can obtain the same interface through a factory. Or if the client is not using the library a standard HTTP request also works.</p>
  
  <p>I know that there are the major ways of either using HTTP Basic Auth or sending a token to requests requiring authenticated users.</p>
  
  <p>The first method (HTTP Basic Auth), has the following issues (partly web browser specific):</p>
  
  <ul>
  <li>The password is transmitted with every request - even with SSL this has some kind of "bad feeling".</li>
  <li>Since the password is transmitted with a request header, it would be easy for an local attacker to look at the transmitted headers to gain the password.</li>
  <li>The password is available in the browsers memory.</li>
  <li>No standard way to expire user "sessions".</li>
  <li>Login with a browser interrupts the look and feel of a page.</li>
  </ul>
  
  <p>The issues for the second method are more focused on implementation and library use:</p>
  
  <ul>
  <li>Each request URI which needs authentication must have a parameter for the token, which is just very repetitive.</li>
  <li>There is a lot more code to write if each method implementation needs to check if a token is valid.</li>
  <li>The interface will become less specific e.g. <code>[RestGet("/get/{id}")]</code> vs. <code>[RestGet("/get/{id}/{token}")]</code>.</li>
  <li>Where to put the token: at the end of the URI? after the root? somewhere else?</li>
  </ul>
  
  <hr>
  
  <p>My idea was to pass the token as parameter to the URL like <code>http:/server/user/get/1234?token=token_id</code>.</p>
  
  <p>Another possibility would be to send the parameter as an HTTP header, but this would complicate usage with plain HTTP clients I guess.</p>
  
  <p>The token would get passed back to the client as a custom HTTP header ("X-Session-Id") on each request.</p>
  
  <p>This then could be completely abstracted from the interface, and any implementation needing authentication could just ask which user the token (if given) belongs to.</p>
  
  <p>Do you think this would violate REST too much or do you have any better ideas?</p>