To be RESTful, each HTTP request should carry enough information by itself for its recipient to process it to be in complete harmony with the stateless nature of HTTP.
Okay, I get that HTTP authentication
is done automatically on every message
– but how?
Yes, the username and password is sent with every request. The common methods to do so are basic access authentication and digest access authentication. And yes, an eavesdropper can capture the user’s credentials. One would thus encrypt all data sent and received using Transport Layer Security (TLS).
Would it be bad to have a REST
service, say, /session, that accepts a
GET request, where you’d pass in a
username/password as part of the
request, and returns a session token
if the authentication was successful,
that could be then passed along with
subsequent requests? Does that make
sense from a REST point of view, or is
that missing the point?
This would not be RESTful since it carries state but it is however quite common since it’s a convenience for users; a user does not have to login each time.
What you describe in a “session token” is commonly referred to as a login cookie. For instance, if you try to login to your Yahoo! account there’s a checkbox that says “keep me logged in for 2 weeks”. This is essentially saying (in your words) “keep my session token alive for 2 weeks if I login successfully.” Web browsers will send such login cookies (and possibly others) with each HTTP request you ask it to make for you.