Did I understand REST principles correctly?

Question

RESTful API

Based on what I've learned, the points below are not necessarily REST principles, and if they are not, then they are a consequence of this architectural approach. So, I need a single page web application with a RESTful backend. If I have done something wrong or acted irrationally, please correct me. Here's how I'll do it:

1. SSL
   
2. There are no sessions, and the corresponding logic is not provided on the backend.
   
3. After authorization, a token is issued.
   
   1. Which is allowed (?) to set the expiration date.
      
   2. Which is allowed to be written to a cookie for storage by the client,
      
   3. But which must be explicitly passed in every request that requires the appropriate permissions.
      
   4. Unlike the session, where data about the authorized user and God knows what else is written, the data remains where it should be - in the database (well, or in the query cache), and the token is the key to access this data.
      
4. Only the frontend can read and write cookies.
   
5. I need an ACL, and of course the server will be responsible for it, if necessary, denying the client the appropriate headers and message in the response body. The server receives the request and the token and determines the user's rights to the requested operation, applicable of course to the specified resource or instance.
   
6. In total, the backend logic consists only in interacting with the database and in the ACL, nothing more.
   
7. All business logic is at the front.
   
8. Maybe the frontend will store its state on its own if necessary, or maybe I'll just get by with caching HTTP requests at this point. But, in any case, caching should be (where it can be and is desirable).

A request without a holivar - this is not about the advantages or disadvantages of REST, but about how much the listed provisions correspond to it. And a huge request to the moderators to be condescending to the question of the unambiguity of possible answers, because. This question is of great practical importance.

Answer 1

Only the frontend can read and write cookies.

No, since this is quite a stateless mechanism. It acts like a token.
403 status code. Everything else is optional.
depends on the project.
Depends on the project. If your users do not interact with each other in any way and there is no common data, then yes. In this case, you don't even really need a backend. It is enough to wrap the interface to which monge in the middleware rest.
And if there is a common state for several users, then you will have to transfer part of the business logic to the server. He will act as a single source of truth.
Rest is only about the interaction between the client and the server. It doesn't matter to him what the client is doing there or what the server is doing there.
Pretty well the principles and limitations describing restful are described here:
www.restapitutorial.ru/lessons/whatisrest.html
unfortunately all other information is not complete. For example, there is no mention of how to work with the PATCH method.

Answer 2

https://habrahabr.ru/post/46032/
https://habrahabr.ru/post/50147/
https://habrahabr.ru/post/38730/
https://habrahabr.ru/search/?q=% 5BREST%5D&target_t...