在RESTful API中使用会话真的违反了RESTful吗?我已经看到了许多意见，但我不相信会议是不安宁的。在我看来:
rest不禁止身份验证(否则在RESTful服务中几乎没有用处)
身份验证是通过在请求中发送一个身份验证令牌来完成的，通常是头
这个身份验证令牌需要以某种方式获得，并且可能会被撤销，在这种情况下需要更新
身份验证令牌需要由服务器验证(否则就不是身份验证)
那么会话是如何违背这一点的呢?
客户端，会话是使用cookie实现的
cookie只是一个额外的HTTP报头
会话cookie可以在任何时候获得和撤销
如果需要，会话cookie可以有无限的生存时间
会话id(身份验证令牌)在服务器端得到验证
As such, to the client, a session cookie is exactly the same as any other HTTP header based authentication mechanism, except that it uses the Cookie header instead of the Authorization or some other proprietary header. If there was no session attached to the cookie value server-side, why would that make a difference? The server side implementation does not need to concern the client as long as the server behaves RESTful. As such, cookies by themselves should not make an API RESTless, and sessions are simply cookies to the client.
我的假设错了吗?是什么使会话cookie不安分?
首先，REST不是宗教，不应该被当作宗教来对待。虽然REST式服务有很多优点，但您应该只在应用程序有意义时才遵循REST的原则。
That said, authentication and client side state do not violate REST principles. While REST requires that state transitions be stateless, this is referring to the server itself. At the heart, all of REST is about documents. The idea behind statelessness is that the SERVER is stateless, not the clients. Any client issuing an identical request (same headers, cookies, URI, etc) should be taken to the same place in the application. If the website stored the current location of the user and managed navigation by updating this server side navigation variable, then REST would be violated. Another client with identical request information would be taken to a different location depending on the server-side state.
Google's web services are a fantastic example of a RESTful system. They require an authentication header with the user's authentication key to be passed upon every request. This does violate REST principles slightly, because the server is tracking the state of the authentication key. The state of this key must be maintained and it has some sort of expiration date/time after which it no longer grants access. However, as I mentioned at the top of my post, sacrifices must be made to allow an application to actually work. That said, authentication tokens must be stored in a way that allows all possible clients to continue granting access during their valid times. If one server is managing the state of the authentication key to the point that another load balanced server cannot take over fulfilling requests based on that key, you have started to really violate the principles of REST. Google's services ensure that, at any time, you can take an authentication token you were using on your phone against load balance server A and hit load balance server B from your desktop and still have access to the system and be directed to the same resources if the requests were identical.
归根结底，您需要确保您的身份验证令牌是针对某种类型的备份存储(数据库、缓存等)进行验证的，以确保您尽可能多地保留REST属性。
我希望你能理解。如果你还没有，你也应该看看维基百科文章中关于具象状态转移的约束部分。关于REST的原则实际上在争论什么以及为什么争论，它特别具有启发性。
实际上，正如通用资源标识符所指示的那样，RESTfulness只应用于资源。因此，在REST中谈论诸如头文件、cookie等都是不合适的。REST可以在任何协议上工作，即使它通常是在HTTP上完成的。
主要的决定因素是:如果您发送一个REST调用(它是一个URI)，那么一旦调用成功地到达服务器，假定没有执行转换(PUT、POST、DELETE)，该URI是否返回相同的内容?这个测试将排除错误或正在返回的身份验证请求，因为在这种情况下，请求还没有到达服务器，这意味着servlet或应用程序将返回与给定URI对应的文档。
同样，在POST或PUT的情况下，是否可以发送给定的URI/有效负载，并且无论发送多少次消息，它都将始终更新相同的数据，以便后续的get将返回一致的结果?
REST是关于应用程序数据的，而不是关于传输数据所需的低级信息。
在下面这篇博文中，Roy Fielding对整个REST思想做了一个很好的总结:
http://groups.yahoo.com/neo/groups/rest-discuss/conversations/topics/5841
"A RESTful system progresses from one steady-state to the
next, and each such steady-state is both a potential start-state
and a potential end-state. I.e., a RESTful system is an unknown
number of components obeying a simple set of rules such that they
are always either at REST or transitioning from one RESTful
state to another RESTful state. Each state can be completely
understood by the representation(s) it contains and the set of
transitions that it provides, with the transitions limited to a
uniform set of actions to be understandable. The system may be
a complex state diagram, but each user agent is only able to see
one state at a time (the current steady-state) and thus each
state is simple and can be analyzed independently. A user, OTOH,
is able to create their own transitions at any time (e.g., enter
a URL, select a bookmark, open an editor, etc.)."
至于身份验证的问题，无论它是通过cookie还是报头完成的，只要信息不是URI和POST有效负载的一部分，它就与REST完全没有关系。因此，关于无状态，我们只讨论应用程序数据。
例如，当用户在GUI屏幕上输入数据时，客户端会跟踪哪些字段已经输入，哪些字段没有输入，哪些必需的字段丢失等等。这都是CLIENT CONTEXT，服务器不应该发送或跟踪。发送到服务器的是需要在IDENTIFIED资源中(通过URI)修改的完整字段集，以便在该资源中发生从一个RESTful状态到另一个RESTful状态的转换。
因此，客户端会跟踪用户正在做什么，并且只向服务器发送逻辑上完整的状态转换。
