HTTP by being a REST-oriented protocol, has most of the architectural properties that N. Alex Rupp wants, so it's good to see him mention the REST thesis as an influence. Where HTTP does fall down (or more accurately, where browsers fall down) is session management. I think the answer to this is to place the session state under a URL space distinct from the web application space the client is accessing. That way both the server and client (or any authorized third party) can refer to it in way that doesn't induce the security problems posed by cookies.
Recent Comments