I&#x27;m reading here that a big problem with many REST APIs is that they don&#x27;t go all the way with the concept. They fall short of the total, so miss out on the overall benefit.<p>But if there are any here who are strong advocates, I truly want to know, how do we authenticate in a REST compliment way in practice? Must we, as was pushed early on, only use HTTP basic auth, and resend credentials with each request? Or do we treat the session itself as resource, and somehow refernce it in requests for all other resources? Or are session cookies somehow exempt from the rule that <i>interactions</i> must be stateless?