A little bit of RPC?

[Alex Rades]

Hi,
I have an api responding to /api/users/<username> which gives
informations about a particular user.
Now I need to give the ability to clients of my api to check if a
username with a given password is a valid user.

I'm thinking about extending the api to accept /api/users/<username>/
<password> and adding a field in the response which tells if the
<username>,<password> pair is ok, but it feels a little bit an HACK.

How would you deal with this problem?

Thanks!

[stephan preeker]

Piston can take care of authentication for you. Most securely With Oath.
Piston also supports basic http authentication, which sends username and password with the url.
So what you want is already there, I guess you are reinventing the wheel..

External apps don't need to know the username and password for a user if you use Oauth. That's why oauth is invented.

HTH

Stephan.