Supporting a RESTful service - Should I use Pragma, Cookies, a Custom Header or something else to identify client sessions and transactions?

Viewed 641

The problem

We are building an SOA with a RESTful approach to the services. Once the systems are in production we will have many clients consuming the interface including internal and 3rd party systems.

We would like to be able to consume and echo in the response information provided by the client application such as: -

  • Session Id - Could be a Java EE session id or anything client specific, this is useful for the support team and debugging client issues to trace them through all our systems.
  • Transaction Id - A unique identifier for the request that we can echo back to the client to aid the client in request/response correlation if they invoke the service asynchronously or if we implement an 202 Accepted style long running process.

Potential solutions

So sticking to the RESTful constraints would suggest we need to utilise HTTP to implement this and there are several options we could implement.

  • Pragma header - implement extension-pragmas for transaction-id, session-id, etc. This seems like purist of solutions as it utilises a standard HTTP header although I would be concerned it became a dumping ground for everything we can't be bothered to think about properly.
  • X-My-Header - custom headers for each field we require. May be stripped by proxies, not core HTTP so feels anti-rest
  • In query string or XML/JSON representations - Add the fields to all our resources. Because it's an operational parameter it feels like it should be provided as metadata rather than on a resource.
  • Cookies - use Cookie and Set-Cookie to hold custom key-values; useful in the case of session ids as most implementations use cookies already. Would have to re-send every time to support client side correlation which kind of defeats the point of using a cookie.

The answer

Is there any precedent for this? Are we mad? Is there something obvious I am missing in all my research? Does no-one actually care how they will support their services once they are deployed? Should I just shut up and go away?

I'm hoping someone can help.

P.S. sorry if this is a bit of an essay, the advice did say "be specific"....

2 Answers
Related