Search code examples
restrestful-authenticationrestful-urlrestful-architecture

RESTful authentication API design

I have a question regarding RESTful API design. Following the guidelines of REST, all endpoints should be nouns and in plural, and should never be verbs. However, it is customary to have authentication routes be:

/login
/logout

which are both verbs. If you should be true to the guidelines these routes should look more like this instead:

/users?action=login
/users?action=logout

but I've never used any API that has this particular authentication implementation, everyone uses the first one, me included. But I wonder if this is because many people don't follow the guidelines fully and it has just become a habit or is there another reason?

Solution

  • If you want to be compliant with the rest guidelines, your api should expose a security token resource as follows for instance :

    /security/token

    And that's it... You can then GET security tokens (login), use them, then DELETE them (logout)