RESTful API认证时机与方式咨询：基于Google Auth ID Token的实践困惑

Great question—this is a super common pain point when moving from a quick-and-dirty API setup to a proper RESTful one. Let's walk through each part of your confusion with real-world best practices:

First off, using POST for every action (with an action field in the body) goes against core RESTful principles. REST uses HTTP methods to express intent:

• Use GET for retrieving data (like fetching a single user)
• Use POST for creating new resources
• Use PUT/PATCH for updating existing resources
• Use DELETE for removing resources

Mature APIs like GitHub, Stripe, and Google Cloud all follow this pattern because it makes your API intuitive, cacheable (GET requests can be cached by browsers/proxies), and aligned with how the web was designed. So yes—you absolutely should switch to GET for fetching user data.

Here's a critical rule: never put sensitive authentication tokens in a GET request's URL or query parameters. URLs get logged in browser history, server access logs, proxy logs, and can even leak via referrer headers. That's a huge security risk.

Instead, send your Google Auth ID Token in the HTTP request header, using the standard Authorization header with the Bearer scheme, like this:

Authorization: Bearer <your-google-idtoken>

This works for all HTTP methods—GET, POST, PUT, DELETE, etc. And yes, you should validate this token on every request that requires authentication. This isn't "un-RESTful"—in fact, REST's "stateless" requirement means every request must carry all the information needed to authenticate itself. Mature APIs enforce this strictly: Google's own APIs, AWS APIs, and Stripe all require auth headers on every privileged request, regardless of method.

When making the switch:

• Don't remove authentication—if fetching a user's data requires permissions (which it almost certainly does), keep validating the ID Token on the GET request. The only difference is where you send the token (header instead of body).
• Adjust your client code: Instead of sending a POST with action: 'get' and idtoken in the body, send a GET /users/{userId} request with the Authorization: Bearer <token> header. This is a small change, but it makes your API much more standard.
• Keep public endpoints unauthenticated (if any): If you have endpoints that don't require permissions (like fetching public product data), you can skip token validation there—but only if the data is truly public.

To drive the point home, here's how some big players do it:

• Google Cloud APIs: Every request (including GETs for resource data) requires an OAuth 2.0 Bearer Token in the Authorization header. The token is validated on every request to check permissions and validity.
• Stripe API: Uses API keys sent via Authorization: Bearer <api-key> for all requests—whether you're fetching a customer (GET) or creating a charge (POST).
• GitHub API: Requires a Bearer Token in the header for any request that accesses private data (like GETting a user's private repos). Public endpoints can be accessed without auth, but authenticated requests get higher rate limits.

The key takeaway: Align your API with HTTP semantics, keep auth tokens in headers, and validate them on all privileged requests. This is the standard across the industry, and it'll make your API more secure, maintainable, and easy for other developers to work with.

内容的提问来源于stack exchange，提问作者Cacoon