title: How to use token based authorization on REST?
body: <p>So after reading lots about BasicAuth, OAuth, JWT... etc. i came up with this question.</p>
  
  <p>I have a client where some ppl can log in (Authentication is done). When ppl want to do an api call they use the clients GUI and the client is sending some requests to the a webservice endpoint.</p>
  
  <pre><code>host/resources/{id}
  
  //id=path, res=post
  public Response updateResourceById(String id, Resource res) {
  ....
  </code></pre>
  
  <p>So a typical update call could be</p>
  
  <pre><code>POST host/resources/1234 -d={ some json for a resource }
  </code></pre>
  
  <p>Now i don't want every user to have all rights for every reosurce, so i would 
  need to add some info about the user who is doing a request.</p>
  
  <p>For this i was thinking to use some JSON Token with some payload  (or any user info at all). But i was wondering how to send this token correctly in a RESTful API.</p>
  
  <p>My first idea would be to change the code to something like this:</p>
  
  <pre><code>//id=path, token=post
  public Response updateResourceById(String id, Token token) {
  ...
  </code></pre>
  
  <p>The endpoint would not change only the POST data.</p>
  
  <p>Would this be correct or are there other approaches?</p>
  
  <p>Edit: Also possible would be sending the Token via HTTP Header.</p>