> The login token stored in the cookie can always be embedded in the URL
> path, which is what ASP.NET does when you set the "cookieless auth"
> setting to true. I've also done this in non-ASP systems
Yeah, I explicitly ignored that kind of thing since it seems it would be
an even greater violation of REST, and Elliotte "RESTy" Harold's :)
initial point.
/r$
--
Rich Salz, Chief Security Architect
DataPower Technology http://www.datapower.com
XS40 XML Security Gateway http://www.datapower.com/products/xs40.html
XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html
