Having the capability in the URL is theoretically fine, but the issue is
that web servers generally like to log these urls all over the place. :)

Maybe I should have pressed a little more when we initially discussed, but
I think we should remove the userId from the URLs and do authentication and
user identification via the token in the authorization header.


On Mon, Feb 25, 2013 at 1:20 PM, Ryan Kelly <notifications@github.com>wrote:

> In routes/syncstore.js:
>
> > +    }
> > +    request.reply(info);
> > +  });
> > +}
> > +
> > +
> > +// Handler function for getting the items in a collection.
> > +//
> > +// This fetches the while list of items from the syncstore backend, filters
> > +// then based on the "ids" and/or "newer" query parameters, and returns the
> > +// filtered list to the client.
> > +//
> > +// XXX TODO: X-Last-Modified header
> > +//
> > +function getItems(request) {
> > +  var userid = request.params.userid;
>
> If the userid in the URL is derived from the auth secret, then one could
> argue that these are actually capability tokens, which might gain warner's
> support :-)
>
> I don't see the point in a half-and-half approach, we should either (1)
> return the resource identified by the URL, letting auth happen in another
> layer, or (2) remove this information from the URL entirely.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/mozilla/picl-server/pull/26/files#r3142849>.
>
>