Good, POST is probably reasonably bulletproof for the use you describe. As an alternative, I like to transmit any extra authentication tokens and tickets associated with PUT or DELETE in the header -- usually via a cookie with confidentiality and server-only attributes turned on.
- R On Thu, May 15, 2008 at 1:20 PM, Surjendu <[EMAIL PROTECTED]> wrote: > But as Rob said that due to some proxy filters not allowing > entities in get and delete, so we have created separate > resource URI for delete requests and use POST/PUT to > delete the resource on the server. >
