Nic Ferrier wrote:
> Claude Montpetit <claude@...> writes:
>
>
>>Maybe this is off-track, but I think that if a server decides to support
>>sessions using cookies, I think the use of cookies should never be
>>mandatory. Writing simple clients that interact with a REST server
>>should not require the client to manage cookies.
>
>
> Why is that? Cookies are no more onerous to support then
> authentication. Both are "bolt ons".

Ultimately it is a matter of it no longer being a matter of URIs
identifying resources, authentication headers determining access rights,
content headers determining type of representation and other headers
determining what processing should be done in a well-specified manner.

It becomes a matter of URIs partially identifying resources,
authentication headers partially determining access rights content
headers partially determining type of representation and other headers
partially determining what processing should be done along with cookies
doing the Gods know what.