Hi Stephan, Regarding cookie based authentication, we should indeed propose something here. I've added a RFE:
"Support cookie based authentication" http://restlet.tigris.org/issues/show_bug.cgi?id=605 Best regards, Jérôme Louvel -- Restlet ~ Founder and Lead developer ~ http://www.restlet.org Noelios Technologies ~ Co-founder ~ http://www.noelios.com -----Message d'origine----- De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Envoyé : mardi 30 septembre 2008 22:21 À : [email protected] Objet : Re: Using the standalone server Hi Mark, > I'm just making this up as I go along, but I'm not opposed to learning > something in the process :-) So I had envisioned that my Restlet > application would have two logical clients: 1) the browser for some > requests, and 2) embedded Ajax for others. And I'm starting to wonder > if I can reconcile that bipartite model with a stateless server. I > seem to recall reading something about this client side state in the > O'Reilly book on RESTful web services. I should go back and read up > on this. But frankly, the only state I had in mind to track at this > point is whether the user is "logged in" or not. Any suggestions on > how you fellows handle something simple like this would be much > appreciated. HTTP supports authentication. This is also useable by a browser. If a browser requests a status 401 (authentication required), it opens a box, where the user could enter his username and password. The reason why this possibility is not used is IMO, that you can not use the corporate design in this box. The reason that it is not possible is, that the box looks always the same, so that the user will not enter his password in a box, where he is not sure, if it is the right. For this authentication type you could use the class org.retlet.Guard. Another possibilty is to set a cookie, which contains a value that the user is authenticated, and remove this cookie, if you log out. For now Restlet has no support for it, but there are plans for Restlet 1.2 to build a new security package in the API. I think, there should be a solution for this problem. best regards Stephan
