[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation

• To: XML-DEV <xml-dev@l...>
• Subject: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• From: Michael Champion <mc@x...>
• Date: Tue, 6 Jan 2004 13:03:12 -0500
• In-reply-to: <p0601020ebc209c50dbf7@[192.168.254.4]>
• References: <p06010207bc2091af5cae@[192.168.254.4]> <3FFAEABB.4060607@d...> <p0601020ebc209c50dbf7@[192.168.254.4]>

On Jan 6, 2004, at 12:10 PM, Elliotte Rusty Harold wrote:

> At 12:04 PM -0500 1/6/04, Rich Salz wrote:
>
>> I read it.  It appears that good security practices conflict with 
>> REST.  It's nice to hear the RESTafarians admit it.
>
> Possibly you read a message I missed or interpreted it differently. 
> Could you please provide the URL to and quote from the specific 
> message which demonstrates that good security practices conflict with 
> REST?
>

http://groups.yahoo.com/group/rest-discuss/message/3593
Quoth Dr. Fielding, "I think it is more accurate to say that, because 
user identification must be supplied
with each request subject to authentication, that an action like LOGIN 
would only add overhead."

That's at least inconsistent with currently understood best practices, 
although of course he (and you) could be proven right in the long run.

Can anyone point to a secure, scalable, automated [i.e., can be used by 
software as a service as well as humans], and successful site that 
adheres to REST principles?  Amazon probably comes the closest, but the 
tast I tried, Amazon wouldn't do much for me without cookies enabled.  
(I tried a brief experiment disabling cookies awhile ago and was not a 
happy user of the Web As It Is).  Empirical proof that REST really 
works would create a lot more converts than evangelism of its theory.

• Follow-Ups:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Elliotte Rusty Harold <elharo@m...>

• References:
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Participation
    • From: Rich Salz <rsalz@d...>
  • Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Next by Date: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Previous by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Particip ation
• Next by thread: Re: Re: Cookies at XML Europe 2004 -- Call for Participation
• Index(es):
  • Date
  • Thread