ezsystems/ezpublish-kernel — pull request #753 by StephaneDiot (2014-02-26 17:07:33+00:00)
Title: impl/EZP-22163 DRAFT : DO NOT MERGE OR REVIEW As a REST User I need to re authenticate existing session on login

Currently only draft !

Suggestion from https://github.com/ezsystems/ezpublish-kernel/pull/682

The goal here is to change the existing POST /user/sessions to allow for common use case needed by session based REST clients, re authenticate a user when he comes back to application but while session cookie is still existing (session cookie might not be available to javascript for security reasons btw).

Two points :
In a first hand POST /user/sessions with a correct login / pass and with session cookie gives:

If the session differs, 201 like now (or other response code as we can't provide Location header)

If the corresponding session exists, 200 with the same response as for the previous case

In a second hand POST /user/sessions//refresh A new resource where you can POST with session cookie and csrf token :

If the session is valid => 200 (204 would work if we don't provide a body)

404 if the session is not valid

JIRA link : https://jira.ez.no/browse/EZP-22163