Re: REST web service APIs

[Nathan Andelin <nandelin@xxxxxxxxx>]

Sound like we're pretty much on the same page, Todd. The completion of a
successful authentication (testing to ensure that the user is the
individual who they say they are) might generate a "token" that can be
passed back and forth between web-service client and web-service provider
during the course of a "session", and also be cross-referenced back to the
user ID, which then provides a basis for testing "authority".



On Fri, Mar 23, 2018 at 12:01 PM, Allen, Todd <Todd.Allen@xxxxxxxxxxxxxxxxx>
wrote:

> I am talking about what happens *AFTER* user authentication.  The
> successful authentication gets you the token.  All requests after that
> check that token.
>
> Of course there is a difference between authentication and authorization.
> You can do authorization the same way.  Check the authority on each
> authenticated request and send back the proper HTTP response code.
>
> Thanks,
> Todd