Is it RESTful to use a HEAD request reveal the existence of a protected resource?
architecture, http, rest
Solution
I would go the 404/401 route. It's much simpler and more orthogonal. And also because the first line of the definition of HEAD reads:
The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response.
And this would leave the way open for HTTP clients that don't support HEAD. Unauthenticated they can simply perform a GET to determine the resource's existence. No HEAD support necessary.
Problem
I have a RESTful resource whose representation should only be retrieved by authenticated clients. In the case of an unauthenticated client making a GET request, a 401 will be returned. On the other hand, I want unauthenticated clients to be able to determine if the resource exists. In this case I am considering having a HEAD request return a 200 if the resource does exist and a 404 if it does not. RFC 2616 says the following about a HEAD request in Section 9.4 The metainformation contained in the HTTP headers in response to a HEAD request SHOULD be identical to the information sent in response to a GET request. Would this approach be considered properly RESTful? As an alternative, I could have the GET and HEAD requests return 404 for a non existent resource and 401 if the request exists but the client is not entitled.