Key Roles of Session State: Not against REST Architectural Style

Abstract

The modern Web architecture basically follows the Representational State Transfer (REST) style. This style offers the architectural properties necessary to implement the Internet-scale Web. However, most authentication and delegation technologies that rely on session state actually deviate from the REST style. It must be noted, however, that the diversity of these technologies is imperative for the success of the Web. In this paper, we make a detailed analysis of current authentication and delegation technologies including OpenID and OAuth as well as HTML forms and cookies, and find that session state has an important role in terms of the diversity of the technologies. We also clarify that the negative impact of session state on the REST style is rather limited. On the basis of our analysis, this paper introduces the REST Using Session (RESTUS) architectural style, which is an extended REST style for sessions; this style places a session constraint on component interactions and so induces some properties required for the diversity.