RFC 2617 or http authentication is considered an implementation detail, so it's not part of the Auth package. So you need to implement it the same way as you would implement a normal login page.
You should use login(), not validate_user(), and if you look at my example, you'll see there is interaction with the user, code that belongs in a controller.
For REST authentication there are a lot of different solutions, depending on your requirements.
Also, if the REST API is used app-to-app (and not through js in the browser), you need to implement a token exchange mechanism to compensate for the lack of session state (no cookies to maintain the session).
Like for similar issues where you have interaction between server-side and client-side, Fuel doesn't force a solution on you, but allows you to choose your solution based on your own requirements.
Donate
