# REST, sessions, authentication **URL:** \ **Category:** Rails\ **Created:** [November 24, 2006, 2:45pm UTC](https://www.ruby-forum.com/t/rest-sessions-authentication/77127 "2006-11-24T14:45:56Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mattias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/cab0a1/32.png) [@mattias](https://www.ruby-forum.com/u/mattias)\ **Post date:** [November 24, 2006, 2:45pm UTC](https://www.ruby-forum.com/t/rest-sessions-authentication/77127/1 "2006-11-24T14:45:56Z")
Hello! I have been trying to read up on this REST stuff that everyone is talking about. 🙂 It all seems very nice, but I can’t seem to handle user sessions and still have pretty URLs. Perhaps someone here has a solution. As far as I can see, rails sessions breaks REST since the session the cookie refers to state located on the server. Another way to handle sessions would be to make them a resource and then refer to a session in the URL. Something like: [http://host/controller/action?session=xyz](http://host/controller/action?session=xyz) This is in my opinion not as nice as the same URL with no session id suffix. My main gripe with session ids in the URL is that the URL isn’t bookmarkable in the same way as a URL without a session id. It might also be confusing for the end user if he wants to share an URL with a friend. Come to think of it, it might also be a security hole if a user decides to share an URL with a friend. What is this group’s take on REST and sessions? I have just recently started to read about REST so I might have missed something important. In that case maybe someone here can point me to some right direction. Regards, Mattias ---
**Author:** ![mattias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/cab0a1/32.png) [@mattias](https://www.ruby-forum.com/u/mattias)\ **Post date:** [November 24, 2006, 2:59pm UTC](https://www.ruby-forum.com/t/rest-sessions-authentication/77127/2 "2006-11-24T14:59:57Z")
As far as i know (and admittedly i dont know THAT much) Cookie information is sent in the header of a browser request alongside with POST, GET etc … so i dont see an reason REST should break sessions? I have to say i didnt rellay work with REST though. Got any links to read up on this? Never heard about this issue … ---
**Author:** ![mattias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/cab0a1/32.png) [@mattias](https://www.ruby-forum.com/u/mattias)\ **Post date:** [November 24, 2006, 3:31pm UTC](https://www.ruby-forum.com/t/rest-sessions-authentication/77127/3 "2006-11-24T15:31:59Z")
On Nov 24, 2:52 pm, “Thorsten L” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > As far as i know (and admittedly i dont know THAT much) Cookie > information is sent in the header of a browser request alongside with > POST, GET etc … so i dont see an reason REST should break sessions? > I have to say i didnt rellay work with REST though. > > Got any links to read up on this? Never heard about this issue … I found this link: [Yahoo | Mail, Weather, Search, Politics, News, Finance, Sports & Videos](http://groups.yahoo.com/group/rest-discuss/message/3583) in the REST FAQ: [http://rest.blueoxen.net/cgi-bin/wiki.pl?RestFaq](http://rest.blueoxen.net/cgi-bin/wiki.pl?RestFaq) :.:: mattias ---
**Author:** ![mattias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/cab0a1/32.png) [@mattias](https://www.ruby-forum.com/u/mattias)\ **Post date:** [November 27, 2006, 11:37am UTC](https://www.ruby-forum.com/t/rest-sessions-authentication/77127/4 "2006-11-27T11:37:12Z")
Alan F. wrote: > Rick’s restful\_authentication plugin makes uses and sessions into > resources. > > login =\> session/create > logout =\> session/destroy > signup =\> user/new > > [http://www.agilewebdevelopment.com/plugins/restful\_authentication](http://www.agilewebdevelopment.com/plugins/restful_authentication) Can anyone tell me what a URL would look like using this plugin? How is the session resource specified when using a controller other than the session controller? :.:: brasse ---
**Author:** ![mattias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/cab0a1/32.png) [@mattias](https://www.ruby-forum.com/u/mattias)\ **Post date:** [November 24, 2006, 3:41pm UTC](https://www.ruby-forum.com/t/rest-sessions-authentication/77127/5 "2006-11-24T15:41:55Z")
Rick’s restful\_authentication plugin makes uses and sessions into resources. login =\> session/create logout =\> session/destroy signup =\> user/new [http://www.agilewebdevelopment.com/plugins/restful\_authentication](http://www.agilewebdevelopment.com/plugins/restful_authentication) A. ---
**Author:** ![mattias](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/cab0a1/32.png) [@mattias](https://www.ruby-forum.com/u/mattias)\ **Post date:** [November 27, 2006, 2:20pm UTC](https://www.ruby-forum.com/t/rest-sessions-authentication/77127/6 "2006-11-27T14:20:45Z")
Mattias Brändström wrote: > Alan F. wrote: > > > Rick’s restful\_authentication plugin makes uses and sessions into > > resources. > > > > login =\> session/create > > logout =\> session/destroy > > signup =\> user/new > > > > [http://www.agilewebdevelopment.com/plugins/restful\_authentication](http://www.agilewebdevelopment.com/plugins/restful_authentication) > > Can anyone tell me what a URL would look like using this plugin? How is > the session resource specified when using a controller other than the > session controller? Just like above… > **[应用宝官网-全网最新最热手机应用游戏下载](http://myapp.com/session/create)** > > 应用宝是腾讯旗下官方手机app应用商店，致力于为您提供海量、优质、安全、最新的安卓应用游戏下载！ > **[应用宝官网-全网最新最热手机应用游戏下载](http://myapp.com/session/destroy)** > > 应用宝是腾讯旗下官方手机app应用商店，致力于为您提供海量、优质、安全、最新的安卓应用游戏下载！ > **[应用宝官网-全网最新最热手机应用游戏下载](https://sj.qq.com)** > > 应用宝是腾讯旗下官方手机app应用商店，致力于为您提供海量、优质、安全、最新的安卓应用游戏下载！ But again, like above, they’re conveniently mapped to /login /logout and /signup Oh hold on, you mean how is the current session tracked ? Just like normal session tracking, via a cookie. Inside your controller, you have access to methods like logged\_in? to tell if you’re logged in yet, a handy before\_filter to redirect for login, and even optional ‘remember me’ functionality which can auto login from a previous cookie. You can access ‘current\_user’ to get the current user out of the session when required. It’s a REALLY sweet plugin. A.