I would like to develop a website, with reusable API - and REST-sty;e one should suite quite well.
Lets say that each user can store information about books they like. So I have many users, and each of them can have many books.

As I suppose, I would get list of books by some kind of request as below:

```
GET /book

```

**But.**

User should list only **his** books, not all of them, that are stored on the server. So how to do this properly?

As I read through many SO Q&A, it seems to be not RESTful to leverage standard authentication with cookies and session id (like it is common with PHP or others), because it preserves state on the server.
Then, first request (GET /book) would not return any results (user not logged in), and after logging, it would return list of this user's books.

Another solution I came across, is to append credentials to every request, like:

```
GET /book?user=john&pass=1234

```

Despite of TLS (HTTPS) requirement of that (because of plaintext data), it just seems wrong. Seems like redundancy, bandwith waste, each-request validation etc.

**My question is:**

If I am not wrong, how to do this good way? Both from the good programming point of view, and performance/network usage prespective?

And maybe REST is not suitable for user owned data?

EDIT:
And OAuth and similar solutions seem way too complicated (and they add overhead too, I think?).