- Devel - oVirt List Archives

[Engine-devel] about ovirt-engine-sdk
by leaboy＠126 02 May '13

02 May '13

ÕâÊÇÒ»·â MIME žñÊœµÄ¶à²¿·ÖÓÊŒþ¡£ ------=_NextPart_000_000B_01CE4723.27810F40 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi,all How can I use overt-engine-sdk in the python environment below python2.7, For example, when I use it in python 2.6.5 like thus: percy@percy-desktop:~/thtf-client$ python --version Python 2.6.5 percy@percy-desktop:~/thtf-client$ python Python 2.6.5 (r265:79063, Oct 1 2012, 22:04:36) [GCC 4.4.3] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> from ovirtsdk.api import API >>> from ovirtsdk.xml import params >>> api = API('http://192.168.1.181', 'admin@internal', '111111', None, None, '~/.spicec/ca.crt', None, None, True) Traceback (most recent call last): File "<stdin>", line 1, in <module> File "ovirtsdk/api.py", line 107, in __init__ url='/api') File "ovirtsdk/infrastructure/proxy.py", line 129, in request last=last) File "ovirtsdk/infrastructure/proxy.py", line 171, in __doRequest return params.parseString(response_body) if response_body is not None and response_body is not '' \ File "ovirtsdk/xml/params.py", line 21229, in parseString rootObj.build(rootNode) File "ovirtsdk/xml/params.py", line 20304, in build self.buildAttributes(node, node.attrib, []) File "ovirtsdk/xml/params.py", line 20309, in buildAttributes super(API, self).buildAttributes(node, attrs, already_processed) File "ovirtsdk/xml/params.py", line 4160, in buildAttributes value = find_attr_value_('xsi:type', node) File "ovirtsdk/xml/params.py", line 316, in find_attr_value_ namespace = node.nsmap.get(prefix) AttributeError: nsmap >>> But, when I use it in python 2.7.3, it's ok leaboy@leaboy:~/workspace/thtf-client$ python --version Python 2.7.3 leaboy@leaboy:~/workspace/thtf-client$ python Python 2.7.3 (default, Aug 1 2012, 05:16:07) [GCC 4.6.3] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> from ovirtsdk.api import API >>> from ovirtsdk.xml import params >>> api = API('http://192.168.1.181', 'admin@internal', '111111', None, None, '~/.spicec/ca.crt', None, True) >>> ------=_NextPart_000_000B_01CE4723.27810F40 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)"> <style>  </style>  </head> <body lang=3DZH-CN link=3Dblue vlink=3Dpurple = style=3D'text-justify-trim:punctuation'> <div class=3DSection1> Hi,all<o:p></o:p>          How can I use overt-engine-sdk in the python environment below = python2.7,<o:p></o:p> For example, when I use it in = python 2.6.5 like thus:<o:p></o:p> <o:p> </o:p> percy@percy-desktop:~/thtf-client$ python --version<o:p></o:p> Python = 2.6.5<o:p></o:p> percy@percy-desktop:~/thtf-client$ = python<o:p></o:p> Python 2.6.5 (r265:79063, = Oct  1 2012, 22:04:36) <o:p></o:p> [GCC 4.4.3] on = linux2<o:p></o:p> Type "help", "copyright", "credits" or "license" for = more information.<o:p></o:p> >>> from ovirtsdk.api = import API<o:p></o:p> >>> from ovirtsdk.xml = import params<o:p></o:p> >>> api =3D API('http://192.168.1.181', 'admin@internal', '111111', None, None, = '~/.spicec/ca.crt', None, None, True)<o:p></o:p> Traceback (most recent call = last):<o:p></o:p>   File = "<stdin>", line 1, in <module><o:p></o:p>   File = "ovirtsdk/api.py", line 107, in __init__<o:p></o:p>     = url=3D'/api')<o:p></o:p>   File "ovirtsdk/infrastructure/proxy.py", line 129, in = request<o:p></o:p>     = last=3Dlast)<o:p></o:p>   File "ovirtsdk/infrastructure/proxy.py", line 171, in = __doRequest<o:p></o:p>     return params.parseString(response_body) if response_body is not None and response_body is not '' \<o:p></o:p>   File "ovirtsdk/xml/params.py", line 21229, in = parseString<o:p></o:p>     rootObj.build(rootNode)<o:p></o:p>   File "ovirtsdk/xml/params.py", line 20304, in = build<o:p></o:p>     self.buildAttributes(node, node.attrib, [])<o:p></o:p>   File "ovirtsdk/xml/params.py", line 20309, in = buildAttributes<o:p></o:p>     super(API, self).buildAttributes(node, attrs, = already_processed)<o:p></o:p>   File "ovirtsdk/xml/params.py", line 4160, in = buildAttributes<o:p></o:p>     value =3D find_attr_value_('xsi:type', node)<o:p></o:p>   File = "ovirtsdk/xml/params.py", line 316, in find_attr_value_<o:p></o:p>     namespace = =3D node.nsmap.get(prefix)<o:p></o:p> AttributeError: = nsmap<o:p></o:p> >>><o:p> </o:p> <o:p> </o:p> <o:p> </o:p> But, when I use it in python = 2.7.3, it’s ok<o:p></o:p> <o:p> </o:p> leaboy@leaboy:~/workspace/thtf-client$ python --version<o:p></o:p> Python = 2.7.3<o:p></o:p> leaboy@leaboy:~/workspace/thtf-client$ python<o:p></o:p> Python 2.7.3 (default, Aug  = 1 2012, 05:16:07) <o:p></o:p> [GCC 4.6.3] on = linux2<o:p></o:p> Type "help", "copyright", "credits" or "license" for = more information.<o:p></o:p> >>> from ovirtsdk.api = import API<o:p></o:p> >>> from ovirtsdk.xml = import params<o:p></o:p> >>> api =3D API('http://192.168.1.181', 'admin@internal', '111111', None, None, '~/.spicec/ca.crt', None, True)<o:p></o:p> >>><o:p> </o:p> </div> </body> </html> ------=_NextPart_000_000B_01CE4723.27810F40--

1 0

Re: [Engine-devel] Root password to add Host
by Alon Bar-Lev 01 May '13

01 May '13

Please reply to 'all'. When you login as admin you should be presented with Text User Interface. Within this interface there should be options on the left and a dialog on the right. At the left you should see 'ovirt-engine' or similar option, when selecting it, you should see on the right an input field of address of the ovirt-engine server, specifying the engine address and selecting apply will initiate registration into the engine. Once registered, you should see the host in the engine, select it and click on "Approve". Another option is to specify password at the same dialog without filling the engine address. This password may be used as the password withi the 'Add Host' dialog. Alon ----- Original Message ----- > From: "Florian BRUSCHET" <florian.bruschet(a)gmail.com> > To: "Alon Bar-Lev" <alonbl(a)redhat.com> > Sent: Wednesday, May 1, 2013 12:00:01 AM > Subject: Re: [Engine-devel] Root password to add Host > > I think I don't really understand what you call TUI? > Yes I'm log as admin on ovirt-node to use Hypervisor > > (And sorry if I make some language faults English isn't my native language > ^^) > > > 2013/4/30 Alon Bar-Lev <alonbl(a)redhat.com> > > > > > You cannot do this via agent by via the TUI of the ovirt-node. > > > > Just to make sure, you are using ovirt-node as hypervisor, right? > > > > ----- Original Message ----- > > > From: "Florian BRUSCHET" <florian.bruschet(a)gmail.com> > > > To: "Alon Bar-Lev" <alonbl(a)redhat.com> > > > Sent: Tuesday, April 30, 2013 11:47:53 PM > > > Subject: Re: [Engine-devel] Root password to add Host > > > > > > Oh ok, i didn't know ... > > > > > > I was looking my oVirt Engine and i don't understand how i can add an > > Host > > > without this password ... > > > For me i have to right click on the Hosts panel, select "new" and it asks > > > me to give name, address and Root password. > > > I have already register this Host from oVirt Node Hypervisor, i add my > > > Management Server and there is no problem i can see "Certificate Status : > > > Verified" but this Host don't appears in the Web page ... > > > > > > > > > 2013/4/30 Alon Bar-Lev <alonbl(a)redhat.com> > > > > > > > > > > > > > > > ----- Original Message ----- > > > > > From: "Florian BRUSCHET" <florian.bruschet(a)gmail.com> > > > > > To: "Alon Bar-Lev" <alonbl(a)redhat.com> > > > > > Sent: Tuesday, April 30, 2013 11:06:14 PM > > > > > Subject: Re: [Engine-devel] Root password to add Host > > > > > > > > > > For me single mode it's when you add "single" at the end of the > > kernel > > > > > commande line like that you boot on shell commande as > > > > > root@localhostand > > > > > you can do what you want. > > > > > > > > Oh... this is "single user mode"... :) > > > > > > > > > > > > > > I will try it soon! > > > > > > > > > > Thank you > > > > > > > > > > Florian > > > > > > > > > > > > > > > 2013/4/30 Alon Bar-Lev <alonbl(a)redhat.com> > > > > > > > > > > > What is 'single mode'? > > > > > > > > > > > > You should be able to set root password via node TUI, at ovirt tab. > > > > > > Or... you can simply perform registration via the node TUI, so you > > > > don't > > > > > > need to specify password at all. > > > > > > > > > > > > ----- Original Message ----- > > > > > > > From: "Florian BRUSCHET" <florian.bruschet(a)gmail.com> > > > > > > > To: engine-devel(a)ovirt.org > > > > > > > Sent: Tuesday, April 30, 2013 7:28:12 PM > > > > > > > Subject: [Engine-devel] Root password to add Host > > > > > > > > > > > > > > Hi, > > > > > > > > > > > > > > I try to add Host from oVirt Engine Web Administration, but it > > asks > > > > me to > > > > > > > give a Root Password (It's not the same that i used to log in > > admin > > > > on > > > > > > the > > > > > > > Node). > > > > > > > Do i really need this Root Password? Because i can't have it and > > i > > > > don't > > > > > > want > > > > > > > to change it by using single mode... > > > > > > > There is an other solution to add Hosts? > > > > > > > > > > > > > > Thank you, > > > > > > > > > > > > > > Florian BRUSCHET > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > Engine-devel mailing list > > > > > > > Engine-devel(a)ovirt.org > > > > > > > http://lists.ovirt.org/mailman/listinfo/engine-devel > > > > > > > > > > > > > > > > > > > > > > > > > > > >

2 9

Re: [Engine-devel] Root password to add Host
by Alon Bar-Lev 30 Apr '13

30 Apr '13

You cannot do this via agent by via the TUI of the ovirt-node. Just to make sure, you are using ovirt-node as hypervisor, right? ----- Original Message ----- > From: "Florian BRUSCHET" <florian.bruschet(a)gmail.com> > To: "Alon Bar-Lev" <alonbl(a)redhat.com> > Sent: Tuesday, April 30, 2013 11:47:53 PM > Subject: Re: [Engine-devel] Root password to add Host > > Oh ok, i didn't know ... > > I was looking my oVirt Engine and i don't understand how i can add an Host > without this password ... > For me i have to right click on the Hosts panel, select "new" and it asks > me to give name, address and Root password. > I have already register this Host from oVirt Node Hypervisor, i add my > Management Server and there is no problem i can see "Certificate Status : > Verified" but this Host don't appears in the Web page ... > > > 2013/4/30 Alon Bar-Lev <alonbl(a)redhat.com> > > > > > > > ----- Original Message ----- > > > From: "Florian BRUSCHET" <florian.bruschet(a)gmail.com> > > > To: "Alon Bar-Lev" <alonbl(a)redhat.com> > > > Sent: Tuesday, April 30, 2013 11:06:14 PM > > > Subject: Re: [Engine-devel] Root password to add Host > > > > > > For me single mode it's when you add "single" at the end of the kernel > > > commande line like that you boot on shell commande as root@localhost and > > > you can do what you want. > > > > Oh... this is "single user mode"... :) > > > > > > > > I will try it soon! > > > > > > Thank you > > > > > > Florian > > > > > > > > > 2013/4/30 Alon Bar-Lev <alonbl(a)redhat.com> > > > > > > > What is 'single mode'? > > > > > > > > You should be able to set root password via node TUI, at ovirt tab. > > > > Or... you can simply perform registration via the node TUI, so you > > don't > > > > need to specify password at all. > > > > > > > > ----- Original Message ----- > > > > > From: "Florian BRUSCHET" <florian.bruschet(a)gmail.com> > > > > > To: engine-devel(a)ovirt.org > > > > > Sent: Tuesday, April 30, 2013 7:28:12 PM > > > > > Subject: [Engine-devel] Root password to add Host > > > > > > > > > > Hi, > > > > > > > > > > I try to add Host from oVirt Engine Web Administration, but it asks > > me to > > > > > give a Root Password (It's not the same that i used to log in admin > > on > > > > the > > > > > Node). > > > > > Do i really need this Root Password? Because i can't have it and i > > don't > > > > want > > > > > to change it by using single mode... > > > > > There is an other solution to add Hosts? > > > > > > > > > > Thank you, > > > > > > > > > > Florian BRUSCHET > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > Engine-devel mailing list > > > > > Engine-devel(a)ovirt.org > > > > > http://lists.ovirt.org/mailman/listinfo/engine-devel > > > > > > > > > > > > > > >

1 0

[Engine-devel] Root password to add Host
by Florian BRUSCHET 30 Apr '13

30 Apr '13

Hi, I try to add Host from oVirt Engine Web Administration, but it asks me to give a Root Password (It's not the same that i used to log in admin on the Node). Do i really need this Root Password? Because i can't have it and i don't want to change it by using single mode... There is an other solution to add Hosts? Thank you, Florian BRUSCHET

2 1

[Engine-devel] Fwd: the procedure of storage-related
by Vered Volansky 29 Apr '13

29 Apr '13

----- Forwarded Message ----- > From: "Vered Volansky" <vered(a)redhat.com> > To: "bigclouds" <bigclouds(a)163.com> > Sent: Sunday, April 28, 2013 12:39:31 PM > Subject: Re: [Engine-devel] the procedure of storage-related > > Hi, > > Find my answers below. > > Best Regards, > Vered > > ----- Original Message ----- > > From: "bigclouds" <bigclouds(a)163.com> > > To: "engine-devel" <engine-devel(a)ovirt.org> > > Sent: Saturday, April 27, 2013 8:40:56 AM > > Subject: [Engine-devel] the procedure of storage-related > > > > hi,all > > 1.i am now not very familar with the right procedure of storage, > > please give me a simply introduction of their concept and relation. > > help > > me out > > > > StoragePool,StorageDomain > > image,volume > > You should find the following link helpful: > http://www.ovirt.org/Vdsm_Storage_Terminology > > As per your other questions, you might find the following guide helpul: > http://www.ovirt.org/Quick_Start_Guide#Configure_Storage > > Of not, please rephrase them as they're not clear enough and I'd rather not > guess. > > > > > > > > 2.please help me confirm. > > i find only one place call mount command, which is > > poolConnectStorageServer. > > if poolConnectStorageServer is before create and active > > StoragePool,StorageDomain? > > > > 3.if attach is just modify metadata, not anything else? > > > > 4.sp.py, deactivateSD > > if i deactivate ISO storage,it finally umount masterDir, why ? > > if masterDir is not mastersd? > > thanks > > > > > > > > _______________________________________________ > > Engine-devel mailing list > > Engine-devel(a)ovirt.org > > http://lists.ovirt.org/mailman/listinfo/engine-devel > > >

3 3

[Engine-devel] oVirt updates - April 28th, 2013
by Itamar Heim 28 Apr '13

28 Apr '13

I thought a summary of things going on from time to time may interest folks: 1. From the Web * Vagrant support for oVirt/RHEV added http://alturl.com/bkauk https://github.com/pradels/vagrant-ovirt http://www.vagrantup.com/ * How to create and provision an oVirt VM with ansible http://www.youtube.com/watch?v=up8X_clAvZk * ovirt_metrics - ActiveRecord-based gem for reading the oVirt History database http://is.gd/hO94Us * DEMO: oVirt - GlusterFS Native Integration for KVM Virtualization http://www.youtube.com/watch?v=0iIuHCz8L04 * Android x86 running on oVirt http://www.youtube.com/watch?v=5nFZLma_Ofw * using oVirt to build a virtualization platform on an IBM BladeCenter http://www.r11networks.com/2013/04/ovirt-meets-ibm-bladecenter/ http://www.r11networks.com/2013/04/ovirt-installation-guide/ 2. Conferences * René Koch (ovido) presented oVirt in a two conferences in Germany oVirt was covered in two OpenStack summit sessions: * Mike Day, IBM: Connected Communities, Innovative Technologies: OpenStack, oVirt, and KVM http://sched.co/WcehtG * Romil Gupta et al, HP: RHEV-M/oVirt Clusters as compute resources http://sched.co/14hte1T http://www.slideshare.net/romilgupta19/hp-rhevmdriverromil) http://alturl.com/vsn5e 3. Bug/feature/patch of the week? Send your candidates for the next update 4. Upcoming * oVirt Shanghai workshop http://www.ovirt.org/Intel_Workshop_May_2013 Feel free to send comments, items, etc for consideration for the next update. Thanks, Itamar

1 0

[Engine-devel] Design wiki page for trusted compute pools integration with oVirt has been updated
by Chen, Wei D 28 Apr '13

28 Apr '13

Hi All, Our second approach for trusted compute pools integration with oVirt seems more simple and sensible than previous VM level approach. Welcome any comments on our latest design. Thanks in advance. Link is here, http://www.ovirt.org/Trusted_compute_pools Best Regards, Dave Chen

6 14

[Engine-devel] the procedure of storage-related
by bigclouds 27 Apr '13

27 Apr '13

------=_Part_127621_1793542873.1367041256436 Content-Type: text/plain; charset=GBK Content-Transfer-Encoding: 7bit hi,all 1.i am now not very familar with the right procedure of storage, please give me a simply introduction of their concept and relation. help me out StoragePool,StorageDomain image,volume 2.please help me confirm. i find only one place call mount command, which is poolConnectStorageServer. if poolConnectStorageServer is before create and active StoragePool,StorageDomain? 3.if attach is just modify metadata, not anything else? 4.sp.py, deactivateSD if i deactivate ISO storage,it finally umount masterDir, why ? if masterDir is not mastersd? thanks ------=_Part_127621_1793542873.1367041256436 Content-Type: text/html; charset=GBK Content-Transfer-Encoding: 7bit <div style="line-height:1.7;color:#000000;font-size:14px;font-family:arial"><div style="color: rgb(0, 0, 0); line-height: 1.7; font-family: arial; font-size: 14px;"><div>hi,all</div><div>1.i am now not very familar with the right procedure of storage, </div><div>    please give me a simply introduction of their concept and relation. help me out</div><div> </div><div>StoragePool,StorageDomain</div><div>image,volume</div><div> </div><div> </div><div>2.please help me confirm.</div><div>i find only one place call mount command, which is poolConnectStorageServer.</div><div>if poolConnectStorageServer is before create and active StoragePool,StorageDomain?</div><div> </div><div>3.if attach is just modify metadata, not anything else?</div><div> </div><div>4.sp.py, deactivateSD</div><div>  if i deactivate ISO storage,it finally umount masterDir, why  ?</div><div>  if masterDir is not  mastersd?</div><div>thanks</div></div> </div> ------=_Part_127621_1793542873.1367041256436--

1 0

[Engine-devel] enable column resizing on all sub-tabs?
by Einav Cohen 25 Apr '13

25 Apr '13

Vojtech[/others] - what do you think about Gilad's comment below? would it be possible / more correct to activate column resizing within the base grid class itself by default (or something similar), rather than enable it separately for each grid? [@Gilad - keep in mind that IIUC - each column in each grid still needs to have its width explicitly set] ---- Thanks, Einav ----- Original Message ----- > From: gchaplik(a)redhat.com > To: "Daniel Erez" <derez(a)redhat.com> > Cc: "Einav Cohen" <ecohen(a)redhat.com>, "Vojtech Szocs" <vszocs(a)redhat.com>, "Alona Kaplan" <alkaplan(a)redhat.com>, > "Tal Nisan" <tnisan(a)redhat.com> > Sent: Thursday, April 25, 2013 3:23:56 AM > Subject: Change in ovirt-engine[master]: webadmin: DataCenters main-tab: sub-tabs resizable columns > > Gilad Chaplik has posted comments on this change. > > Change subject: webadmin: DataCenters main-tab: sub-tabs resizable columns > ...................................................................... > > > Patch Set 4: > > why we need to invoke getTable().enableColumnResizing() on each sub-tab? > don't we want all grid subtabs to have column resizing? > > -- > To view, visit http://gerrit.ovirt.org/14105 > To unsubscribe, visit http://gerrit.ovirt.org/settings > > Gerrit-MessageType: comment > Gerrit-Change-Id: I71465d36e5c18ecb8eb6dbca436feaeea1c902a9 > Gerrit-PatchSet: 4 > Gerrit-Project: ovirt-engine > Gerrit-Branch: master > Gerrit-Owner: Daniel Erez <derez(a)redhat.com> > Gerrit-Reviewer: Alona Kaplan <alkaplan(a)redhat.com> > Gerrit-Reviewer: Daniel Erez <derez(a)redhat.com> > Gerrit-Reviewer: Einav Cohen <ecohen(a)redhat.com> > Gerrit-Reviewer: Gilad Chaplik <gchaplik(a)redhat.com> > Gerrit-Reviewer: Tal Nisan <tnisan(a)redhat.com> > Gerrit-Reviewer: Vojtech Szocs <vszocs(a)redhat.com> >

4 7

[Engine-devel] Proposal to make REST API more webapp-friendly
by Vojtech Szocs 24 Apr '13

24 Apr '13

Hi guys, having worked with Engine REST API from web application (JavaScript) perspective, there are things that could be improved to make REST API more webapp-friendly. First of all, webapps are *not* traditional HTTP clients, i.e. they have *not* full control over HTTP processing. There are some standard conventions and behaviors built into web browsers that any REST API implementation should be aware of. -- (1) Don't force clients to use cookies for transmitting authentication information! (or don't use cookies at all) Good explanation can be found at [http://www.berenddeboer.net/rest/cookies.html] Cookies have many disadvantages: * cookie parsing/formatting is not trivial --> extra complexity imposed on REST clients * in addition to Same-Origin Policy [http://en.wikipedia.org/wiki/Same_origin_policy] cookies can be get/set *only* for the given path --> JavaScript running at [http://example.com/webapp] *cannot* get/set cookies from requests at [http://example.com/restapi] * cookies are the primary source of Cross-Site Request Forgery [http://en.wikipedia.org/wiki/Cross-site_request_forgery] attacks --> malicious websites/scripts can forge requests to REST API that will include the cookie, compromising user session Alternative: clients could be given the *option* to use regular HTTP header for transmitting authentication information. For example, webapp could read such (sensitive information) header, store it securely via HTML5 Session Storage [http://en.wikipedia.org/wiki/Web_storage] and implement related HTTP processing on its own, e.g. pass this header for all authenticated requests (instead of pushing this responsibility to browser). -- (2) Straight-forward HTTP Basic Auth has some drawbacks! HTTP Basic Auth [http://en.wikipedia.org/wiki/Basic_access_authentication] over (non-secure) HTTP connection means sending user credentials (username/password/domain) in easy-to-decode cleartext, i.e. the value is *not* encrypted or hashed in any way. Using secure lower-level protocol (SSL) fixes the consequence, rather than the root cause of the confidentiality issue. Furthermore, browsers typically remember HTTP Basic Auth information (either via browser-specific popup, or via XmlHttpRequest) until the browser window is closed. This means the webapp has no control over HTTP Basic Auth header after it has been set! This is the reason why it's hard to implement "logout" functionality in webapps when using HTTP Basic Auth. Last but not least, HTTP Basic Auth is vulnerable to Replay attacks [http://en.wikipedia.org/wiki/Replay_attack] Someone between client and server can intercept requests and replay them, compromising user session. Alternative: clients could be given the *option* to use more advanced authentication scheme. I've just read an excellent article at [http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authe…] which describes easy yet secure authentication scheme inspired by Amazon Web Services REST API authentication [http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html] The idea is simple: collect auth information, hash (sign) it with a private key, and send everything to server. To guard against Replay attacks, just provide some timestamp to enforce request expiry after some time (say, 5-15 minutes). Easy and simple! -- (3) Support JSON for resource representations! I think this is pretty much obvious. XML has no real advantages over JSON. JSON, on the other hand, has good support in webapps (JavaScript) and maps directly to common data structures (i.e. string, number, boolean, and so on). >From webapp perspective, it's much easier and natural to use JSON than to parse/format XML documents. Alternative: clients could be given the *option* to use JSON, in addition to XML representation. -- Vojtech

4 8