Hi Mark,
I'm just making this up as I go along, but I'm not opposed to learning
something in the process :-) So I had envisioned that my Restlet
application would have two logical clients: 1) the browser for some
requests, and 2) embedded Ajax for others. And I'm starting to wonder
if I can reconcile that bipartite model with a stateless server. I
seem to recall reading something about this client side state in the
O'Reilly book on RESTful web services. I should go back and read up
on this. But frankly, the only state I had in mind to track at this
point is whether the user is "logged in" or not. Any suggestions on
how you fellows handle something simple like this would be much
appreciated.
HTTP supports authentication. This is also useable by a browser. If a
browser requests a status 401 (authentication required), it opens a box,
where the user could enter his username and password. The reason why
this possibility is not used is IMO, that you can not use the corporate
design in this box. The reason that it is not possible is, that the box
looks always the same, so that the user will not enter his password in a
box, where he is not sure, if it is the right.
For this authentication type you could use the class org.retlet.Guard.
Another possibilty is to set a cookie, which contains a value that the
user is authenticated, and remove this cookie, if you log out. For now
Restlet has no support for it, but there are plans for Restlet 1.2 to
build a new security package in the API. I think, there should be a
solution for this problem.
best regards
Stephan
