Single Page Web Applications – Requiring JavaScript

The URL should be used for what it does: locating a resource.

You should put in the URL only things relative to the location of the resource, so users will be able to always find it (bookmark, permalink). With this in mind, you should avoid to insert variables in it or other custom data.

Just look at the link of this question for example, and how easy it is to share between social networks.

You should also consider that many users (like me) may prefer to navigate your site directly from the URL bar. For example playing with numbers. If I'm reading a blog article with a URL containing a folder named 2011, I could try to remove all the URL part up to the year folder, expecting to see a page which contains all the 2011 articles.

Then I could also change 2011 to 2010 to browser last year articles, and so on...

Too often websites provides very basic (and sometimes inefficient or completely absent) navigation commands. It's often easier to navigate a website directly via the URL bar.

Edit

I would also like to add that the URL should describe as much as possible what is the content of the linked resource, using clear keywords, not random numbers or misleading/useless words.

It depends on what you mean by "permissions". I will present some ideas with an example with User and Project resources.

If the permissions are independent of a given Project, then you are really talking about the User having a role (e.g. admin). This can be encoded in the API representation of that User.

If the permissions are dependent on the underlying resource (e.g. a User can have different permissions for a given Project) these can reside in the API representation for that resource. This has the pro that you don't need a huge dictionary of all of a user's permissions and the con that any caching of that resource need to be user specific. This may be an acceptable trade off.

You still have a potential usability issue with stale data if someone loads a view and their permissions for the viewed resource change before they attempt an action. One way to try to mitigate this is to use websockets to push updates to viewed resources to try and reduce the window during which the UI will be out of date with the backend database.