Take the 2-minute tour ×

I am looking for a clean way to handle the situation where you have a resource representing a collection, but the authenticated user may only have authorization to access some subset of the resources in the collection.

For example a blogging api:

GET /post - lists posts

GET /post/1 - get a specific post

Posts can be public or private. So if I have private access, the /post api could return all posts, but if I only had public access it would be limited to returning only the public posts.

How is this normally handled? Are there caching ramifications? Are there issues with maintaining the semantics of GET in this case?

Note: the authentication is handled via a token sent in a request header, not sure if that plays into it as well.

Edit: To clarify I am interested in how to model this correctly in a RESTful system, not how to handle the actual authorization.

share|improve this question
Yes, there are caching ramifications if the same URL might return different values for different users. –  Ben Jul 11 '12 at 13:36
add comment

1 Answer

You can use session variables to set a user's authorization level. When they go to access posts, you can check their authorization level and only return posts that they have authorization for.

More information about sessions and session variables here and here.

share|improve this answer
To clarify, I am not asking how to handle the authorization, I am asking how to model it from a REST perspective. –  see Jul 11 '12 at 13:41
add comment

Your Answer


