# REST web service

**URL:** <https://www.ruby-forum.com/t/rest-web-service/149838>\
**Category:** Rails\
**Created:** [September 30, 2008, 1:02pm UTC](https://www.ruby-forum.com/t/rest-web-service/149838 "2008-09-30T13:02:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![roa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/8e7dd6/32.png) [@roa](https://www.ruby-forum.com/u/roa)\
**Post date:** [September 30, 2008, 1:02pm UTC](https://www.ruby-forum.com/t/rest-web-service/149838/1 "2008-09-30T13:02:18Z")

</div>

Hi

I have a question regarding using Rails as a REST web service. I  
understand the concept and have implemented it into a project.

As far as I’m logged in into the application, I can pull out data in any  
format that is specified in the application.

But lets say that I want to use it as a service. How do I pull the data  
out? When you use SOAP / WSDL, you send your request in xml format  
together with authentication data (login/pass), but how does this work  
in Rails?

In my application, when a user is logged in, his user data gets stored  
in a session. But when you speak with the application through lets say a  
script, I need to send my login data that needs to be verified, but no  
session will be created.

I hope someone can help me in the right direction.

Thank you in advance

---

<div class="post-metadata">

**Author:** ![roa](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/8e7dd6/32.png) [@roa](https://www.ruby-forum.com/u/roa)\
**Post date:** [September 30, 2008, 3:49pm UTC](https://www.ruby-forum.com/t/rest-web-service/149838/2 "2008-09-30T15:49:17Z")

</div>

> But lets say that I want to use it as a service. How do I pull the data  
> out? When you use SOAP / WSDL, you send your request in xml format  
> together with authentication data (login/pass), but how does this work  
> in Rails?

I think most people are using HTTP Basic Authentication for their REST  
web services in Rails. Run this over SSL if you want the transmission to  
be secure.

Yes, it’s not as extensive and flexible as SOAP and WS-\* (deathstar),  
but that’s exactly the point. I’ve done some pretty extensive work with  
WS-\* due to having to integrate with services using it. But, even in  
these cases they really aren’t depending on any more security than that  
provided by the standard web technologies. Just because you provide  
extensive flexibility doesn’t mean that people will use it, or even need  
or want it.

Also, I believe that ActiveResource (and other plugins) pretty much take  
care of handing authentication through HTTP Basic Authentication for  
you. Read up on ActiveResource and see if that helps clear things up a  
bit for you.