title: Do sessions really violate RESTfulness?
body: <p>Is using sessions in a RESTful API really violating RESTfulness? I have seen many opinions going either direction, but I'm not convinced that sessions are <em>RESTless</em>. From my point of view:</p>
  
  <ul>
  <li>authentication is not prohibited for RESTfulness (otherwise there'd be little use in RESTful services)</li>
  <li>authentication is done by sending an authentication token in the request, usually the header</li>
  <li>this authentication token needs to be obtained somehow and may be revoked, in which case it needs to be renewed</li>
  <li>the authentication token needs to be validated by the server (otherwise it wouldn't be authentication)</li>
  </ul>
  
  <p>So how do sessions violate this?</p>
  
  <ul>
  <li>client-side, sessions are realized using cookies</li>
  <li>cookies are simply an extra HTTP header</li>
  <li>a session cookie can be obtained and revoked at any time</li>
  <li>session cookies can have an infinite life time if need be</li>
  <li>the session id (authentication token) is validated server-side</li>
  </ul>
  
  <p>As such, to the client, a session cookie is exactly the same as any other HTTP header based authentication mechanism, except that it uses the <code>Cookie</code> header instead of the <code>Authorization</code> or some other proprietary header. If there was no session attached to the cookie value server-side, why would that make a difference? The server side implementation does not need to concern the client as long as the server <em>behaves</em> RESTful. As such, cookies by themselves should not make an API <em>RESTless</em>, and sessions are simply cookies to the client.</p>
  
  <p>Are my assumptions wrong? What makes session cookies <em>RESTless</em>?</p>