Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Designing HTTP Interfaces and RESTful Web Services

Designing HTTP Interfaces and RESTful Web Services

Presentation at PHP Australia conference in Sydney, Australia.

David Zuelke

March 13, 2015
Tweet

More Decks by David Zuelke

Other Decks in Programming

Transcript

  1. DESIGNING HTTP INTERFACES
    AND RESTFUL WEB SERVICES

    View Slide

  2. David Zuelke

    View Slide

  3. View Slide

  4. View Slide

  5. @dzuelke

    View Slide

  6. THE OLDEN DAYS
    Before REST was En Vogue

    View Slide

  7. http://www.acme.com/index.php?action=zomg&page=lol

    View Slide

  8. along came

    View Slide

  9. K dis
    is srs SEO

    View Slide

  10. and said

    View Slide

  11. NEIN NEIN
    NEIN NEIN
    DAS IST
    VERBOTEN

    View Slide

  12. at least if they were

    View Slide

  13. View Slide

  14. so we had to make URLs "SEO friendly"

    View Slide

  15. http://www.acme.com/zomg/lol

    View Slide

  16. and then things got out of control

    View Slide

  17. because nobody really had a clue

    View Slide

  18. http://acme.com/videos/latest/hamburgers

    View Slide

  19. http://acme.com/search/lolcats/pictures/yes/1/200

    View Slide

  20. oh dear…

    View Slide

  21. THE RISE OF WEB SERVICES
    Ohai, I'm ur CEO, I canhaz SOAP API plz, today, kthx?

    View Slide

  22. POST  /soapendpoint.php  HTTP/1.1  
    Host:  localhost  
    Content-­‐Type:  text/xml;  charset=utf-­‐8  
     
     
         
             
               123456  
             
         

    HTTP/1.1  200  OK  
    Content-­‐Type:  text/xml;  charset=utf-­‐8  
     
     
         
             
                 
                   123456  
                   Red  Stapler  
                   3.14  
                 
             
         

    View Slide

  23. POST  /soapendpoint.php  HTTP/1.1  
    Host:  localhost  
    Content-­‐Type:  text/xml;  charset=utf-­‐8  
     
     
         
             
               987654  
             
         

    HTTP/1.1  500  Internal  Service  Error  
    Content-­‐Type:  text/xml;  charset=utf-­‐8  
     
     
         
             
               SOAP-­‐ENV:Server  
               Unknown  Product    
             
         

    View Slide

  24. SOAP sucks, said everyone

    View Slide

  25. let's build APIs without the clutter, they said

    View Slide

  26. example: the old http://joind.in/ API

    View Slide

  27. POST  /api/talk  HTTP/1.1  
    Host:  joind.in  
    Content-­‐Type:  text/xml;  charset=utf-­‐8  
     
     
                     
                                   Chuck  Norris  
                                   roundhousekick  
                     
                     
                                   42  
                     

    HTTP/1.1  200  OK  
    Content-­‐Type:  text/xml;  charset=utf-­‐8  
     
     
       
        My  Test  Talk  
        This  is  a  sample  talk  description  
        42  
       

    View Slide

  28. PROBLEMS WITH THIS API
    • Always a POST
    • Doesn't use HTTP Authentication
    • Operation information is enclosed in the request ("getdetail")
    • Nothing there is cacheable
    • Everything through one endpoint (/api/talks for talks)

    View Slide

  29. Level 0 in the Richardson Maturity Model:
    Plain old XML over the wire in an RPC fashion

    View Slide

  30. Room for improvement: use one URI for each resource
    “ “

    View Slide

  31. That would be Level 1 in Richardson's Maturity Model

    View Slide

  32. Level 0 and Level 1 are a bag of hurt.
    Do not use them.
    Ever.

    View Slide

  33. ALONG CAME ROY FIELDING
    And Gave Us REST

    View Slide

  34. that was awesome

    View Slide

  35. because everyone could say

    View Slide

  36. J I haz REST nao

    View Slide

  37. when in fact

    View Slide

  38. they absolutely didn’t

    View Slide

  39. REST
    What Does That Even Mean?

    View Slide

  40. REpresentational State Transfer

    View Slide

  41. Roy Thomas Fielding: Architectural styles and
    the design of network based software architectures.

    View Slide

  42. • Client-Server
    • Stateless
    • Cacheable
    • Layered System
    • Code on Demand (optional)
    • Uniform Interface
    REST CONSTRAINTS

    View Slide

  43. • A URL identifies a Resource
    • Methods perform operations on resources
    • The operation is implicit and not part of the URL
    • A hypermedia format is used to represent the data
    • Link relations are used to navigate a service
    UNIFORM INTERFACE

    View Slide

  44. a web page is not a resource

    View Slide

  45. it is a (complete) representation of a resource

    View Slide

  46. GET  /products/  HTTP/1.1  
    Host:  acme.com  
    Accept:  application/json
    HTTP/1.1  200  OK

    Content-­‐Type:  application/json;  charset=utf-­‐8  
    Allow:  GET,  POST  
    [  
       {  
           id:  1234,  
           name:  "Red  Stapler",  
           price:  3.14,  
           location:  "http://acme.com/products/1234"  
       }  
    ]
    GETTING JSON BACK

    View Slide

  47. GET  /products/  HTTP/1.1  
    Host:  acme.com  
    Accept:  application/xml
    HTTP/1.1  200  OK  
    Content-­‐Type:  application/xml;  charset=utf-­‐8  
    Allow:  GET,  POST  
     
     
         
           Red  Stapler  
           3.14  
         

    GETTING XML BACK

    View Slide

  48. but those are not hypermedia formats!

    View Slide

  49. (more on that a bit later)

    View Slide

  50. GET  /products/  HTTP/1.1  
    Host:  acme.com  
    Accept:  application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,*/*;q=0.5  
    User-­‐Agent:  Mozilla/5.0  (Macintosh;  U;  Intel  Mac  OS  X  10_5_8;  en-­‐us)  AppleWebKit…
    HTTP/1.1  200  OK  
    Content-­‐Type:  text/html;  charset=utf-­‐8  
    Allow:  GET,  POST  
     
         
             
           ACME  Inc.  Products  
         
         
           Our  Incredible  Products  
             
               Red  Stapler  (€3.14)  
             
         

    AND FINALLY, HTML

    View Slide

  51. VOLUME ONE
    Designing an HTTP Interface

    View Slide

  52. FIRST: DEFINE RESOURCES
    A Good Approach: Structure Your URLs

    View Slide

  53. "BAD URLS"
    • http://www.acme.com/product/
    • http://www.acme.com/product/filter/cats/desc
    • http://www.acme.com/product/1234
    • http://www.acme.com/photos/product/1234
    • http://www.acme.com/photos/product/1234/new
    • http://www.acme.com/photos/product/1234/5678
    err...?
    photo or
    product ID?
    new what?

    View Slide

  54. "GOOD URLS"
    • http://www.acme.com/products/
    • http://www.acme.com/products/?filter=cats&sort=desc
    • http://www.acme.com/products/1234
    • http://www.acme.com/products/1234/photos/
    • http://www.acme.com/products/1234/photos/?sort=latest
    • http://www.acme.com/products/1234/photos/5678
    a list of products
    filtering is a query
    a single product
    all photos

    View Slide

  55. now here's the ironic part

    View Slide

  56. URLs don't matter once you have a fully RESTful interface

    View Slide

  57. but it’s helpful to think in terms of resources

    View Slide

  58. SECOND: USE RESOURCES
    CRUD, but not really

    View Slide

  59. COLLECTION OPERATIONS
    • http://www.acme.com/products/
    • GET to retrieve a list of products
    • POST to create a new product
    • returns
    • 201 Created
    • Location: http://www.acme.com/products/1235

    View Slide

  60. ITEM OPERATIONS
    • http://www.acme.com/products/1234
    • GET to retrieve
    • PUT to update
    • DELETE to, you guessed it, delete

    View Slide

  61. Now we are at Level 2 in RMM

    View Slide

  62. RMM LEVEL 2
    • Use HTTP verbs
    • GET (safe and idempotent)
    • POST (unsafe, not idempotent)
    • PUT & DELETE (unsafe, idempotent)
    • Use HTTP status codes to indicate result success
    • e.g. HTTP/1.1 409 Conflict

    View Slide

  63. THE TWITTER (V1) API
    Not RESTful, And Not Even Getting HTTP Right :(

    View Slide

  64. mind you we're not even inspecting the RESTfulness

    View Slide

  65. we're just looking at Twitter's API from an HTTP perspective

    View Slide

  66. CURRENT STATE
    • GET http://api.twitter.com/1/statuses/show/12345.json
    • POST http://api.twitter.com/1/statuses/update.json
    • DELETE http://api.twitter.com/1/statuses/destroy/12345.json
    • GET http://api.twitter.com/1/statuses/retweets/12345.json
    • PUT http://api.twitter.com/1/statuses/retweet/12345.json
    Doesn’t allow Accept header
    Why a PUT?
    Why the difference?
    Posts to
    auth’d
    user!
    “DELETE destroy”, RPC much?

    View Slide

  67. COULD BE SO MUCH SIMPLER
    • http://twitter.com/username/statuses/
    • POST to create a new tweet
    • http://twitter.com/username/statuses/12345
    • DELETE deletes (PUT could be used for updates)
    • http://twitter.com/username/statuses/12345/retweets/
    • POST creates a new retweet

    View Slide

  68. INTERMISSION
    What's the Biggest Reason for the Success of the Web?

    View Slide

  69. WWW

    View Slide

  70. first information exchange system

    View Slide

  71. planetary scale

    View Slide

  72. View Slide

  73. View Slide

  74. why is that possible?

    View Slide

  75. Hyperlinks!

    View Slide

  76. no tight coupling!

    View Slide

  77. loosely coupled by design

    View Slide

  78. no notification infrastructure

    View Slide

  79. HTTP/1.1 404 Not Found

    View Slide

  80. embraces failure

    View Slide

  81. more information != more friction

    View Slide

  82. no limits to scalability

    View Slide

  83. WWW is protocol-centric

    View Slide

  84. VOLUME TWO
    RESTful Services with Hypermedia

    View Slide

  85. THE UNIFORM INTERFACE
    • Identification of Resources (e.g. through URIs)
    • Representations are conceptually separate!
    • Manipulation Through Representations (i.e. they are complete)
    • Self-Descriptive Messages (containing all information)
    • Hypermedia As The Engine Of Application State ("HATEOAS")
    "without you I am nothing"

    View Slide

  86. HATEOAS
    The Missing Piece in the Puzzle

    View Slide

  87. ONE LAST PIECE IS MISSING
    • How does a client know what to do with representations?
    • How do you go to the “next” operation?
    • What are the URLs for creating subordinate resources?
    • Where is the contract for the service?

    View Slide

  88. HYPERMEDIA AS THE ENGINE
    OF APPLICATION STATE
    • Use links to allow clients to discover locations and operations
    • Link relations are used to express the possible options
    • Clients do not need to know URLs, so they can change
    • The entire application workflow is abstracted, thus changeable
    • The hypermedia type itself could be versioned if necessary
    • No breaking of clients if the implementation is updated!

    View Slide

  89. (X)HTML and Atom are Hypermedia formats

    View Slide

  90. Or you roll your own...

    View Slide

  91. GET  /products/1234  HTTP/1.1  
    Host:  acme.com  
    Accept:  application/vnd.com.acme.shop+xml
    HTTP/1.1  200  OK  
    Content-­‐Type:  application/vnd.come.acme.shop+xml;  charset=utf-­‐8  
    Allow:  GET,  PUT,  DELETE  
     
     
       1234  
       Red  Stapler  
       3.14

                                 href="http://acme.com/products/1234/payment"/>  

    re-use Atom for

    link relations
    meaning defined in IANA Link Relations list
    A CUSTOM MEDIA TYPE
    Remind clients of
    Uniform Interface :)

    View Slide

  92. boom, RMM Level 3

    View Slide

  93. XML is really good for hypermedia formats

    View Slide

  94. (hyperlinks, namespaced attributes, re-use of formats, …)

    View Slide

  95. JSON is more difficult

    View Slide

  96. (no hyperlinks, no namespaces, no element attributes)

    View Slide

  97.  
     
       1234  
       Red  Stapler  
                                 href="http://acme.com/products/1234/payment"/>  
       3.14


    {  
       id:  1234,  
       name:  "Red  Stapler",  
       links:  [  
           {  
               rel:  "payment",  
               type:  "application/vnd.com.acme.shop+json",  
               href:  "http://acme.com/products/1234/payment"  
           }  
       ],  
       price:  3.14  
    }
    XML VERSUS JSON

    View Slide

  98.  
     
       1234  
       Red  Stapler  
                                 href="http://acme.com/products/1234/payment"/>  
       3.14


    {  
       id:  1234,  
       name:  "Red  Stapler",  
       links:  [  
           {  
               rel:  "payment",  
               type:  "application/vnd.com.acme.shop+json",  
               href:  "http://acme.com/products/1234/payment"  
           }  
       ],  
       price:  {  
           amount:  3.14,  
           currency:  "EUR"  
       }  
    }
    XML VERSUS JSON
    Content (“node value”) still the same
    Float becomes object, stuff breaks

    View Slide

  99. JSON is difficult to evolve without breaking clients

    View Slide

  100. XML’s document model is built for extensibility

    View Slide

  101.  
     
         
           Bacon  
           5.99  
         
     

    View Slide

  102.  
     
         
           Bacon  
           5.99  
           OMNOMNOM  Bacon  
         
     

    View Slide

  103.  
     
         
           Bacon  
           5.99  
         
     

    View Slide

  104.  
     
         
           Bacon  
           5.99  
           4.49  
         
     

    View Slide

  105.  
     
         
           Bacon  
           Speck  
           5.99  
           4.49  
         

    View Slide

  106.  
     
         
           Bacon  
           Speck  
           5.99  
             
         

    View Slide

  107. and hey

    View Slide

  108. without Hypermedia, your HTTP interface is not RESTful

    View Slide

  109. that’s totally fine

    and sometimes even the only way to do it

    View Slide

  110. (e.g. CouchDB or S3 are never going to be RESTful)

    View Slide

  111. just avoid calling it a "REST API" :)

    View Slide

  112. $next  =  'http://shop.com/search?q=sharks';

    while($next)  {

           $doc  =  DOMDocument::loadXML(file_get_contents($url));

           $xpath  =  new  DOMXPath($doc);

           foreach($xpath-­‐>query('/searchResult/product')  as  $product)  {

                   MyMagicDatabase::import($product);

           }

           $next  =  $xpath-­‐>evaluate('/searchResult/link[@rel="next"]/@href');

    }
    WITH HATEOAS, CLIENTS
    BECOME STATE MACHINES
     
             
             
           ...  
           ...  
           ...  

    View Slide

  113. good Hypermedia format example: the Lovefilm API

    View Slide

  114.  
     
       6  
       1  
       1  
                       rel="self"  title="self"/>  
                       rel="next"  title="next"/>  
                       rel="last"  title="last"/>  
         
           true  
           2003-­‐09-­‐12  
             
           http://openapi.lovefilm.com/catalog/title/59643  
           false  
           574  
           4  
             
             
             
             
             
                               rel="http://schemas.lovefilm.com/synopsis"  title="synopsis"/>  
                               rel="http://schemas.lovefilm.com/reviews"  title="reviews"/>  
                               rel="alternate"  title="web  page"/>  
         

    View Slide

  115. ROOM FOR IMPROVEMENT IN
    THE LOVEFILM API
    • Uses application/xml instead of a custom media type
    • Once that is fixed, all the link elements could also have a
    “type” attribute indicating the media type
    • Should use XML namespaces on the root element, with one
    namespace per type (e.g. “urn:com.lovefilm.api.item”,
    “urn:com.lovefilm.api.searchresult” and so on)
    • That way, clients can determine the resource type easily

    View Slide

  116. another great RESTful API: Huddle

    View Slide

  117.    xmlns="http://schema.huddle.net/2011/02/"  
       title="TPS  report  May  2010"  
       description="relentlessly  mundane  and  enervating.">  
         
         
         
         
         
         
         
         
         
         
         
         
             
             
             
         
         
         
             
             
             
         
         
       19475  
         
       98  
       2007-­‐10-­‐10T09:02:17Z  
       2011-­‐10-­‐10T09:02:17Z  
       Complete  
       9  

    View Slide

  118. ROOM FOR IMPROVEMENT IN
    THE HUDDLE API
    • Uses custom rels like “thumb” or “avatar” not defined in the
    IANA registry (http://www.iana.org/assignments/link-relations)
    • Risk of collisions and ambiguity; should use something like
    “http://rels.huddle.net/thumb” instead.
    • Uses one global XML schema and namespace for all entities
    • Clients cannot detect entity type based on namespace
    • Difficult to evolve schema versions independently

    View Slide

  119. API VERSIONING
    Media Types To The Rescue!

    View Slide

  120. why not api.myservice.com/v1/foo/bar?
    and then api.myservice.com/v2/foo/bar?

    View Slide

  121. different URLs means different resources!

    View Slide

  122. also, keep bookmarks (by machines) in mind

    View Slide

  123. GET  /products/1234  HTTP/1.1  
    Host:  acme.com  
    Accept:  application/vnd.com.myservice+xml
    HTTP/1.1  200  OK  
    Content-­‐Type:  application/vnd.com.myservice+xml;  charset=utf-­‐8  
    Allow:  GET,  PUT,  DELETE  
     
                     id="1234"  xl:type="simple"  xl:href="http://acme.com/products/1234">  
       Red  Stapler  
       3.14  

    API VERSION 1

    View Slide

  124. (item sells out...)

    View Slide

  125. GET  /products/1234  HTTP/1.1  
    Host:  acme.com  
    Accept:  application/vnd.com.myservice+xml
    HTTP/1.1  410  Gone  
    Content-­‐Type:  application/vnd.com.myservice+xml;  charset=utf-­‐8
    API VERSION 1

    View Slide

  126. API now offers a new protocol version
    with availability indicators (breaking change!)

    View Slide

  127. GET  /products/1234  HTTP/1.1  
    Host:  acme.com  
    Accept:  application/vnd.com.myservice.v2+xml
    HTTP/1.1  200  OK  
    Content-­‐Type:  application/vnd.com.myservice.v2+xml;  charset=utf-­‐8  
    Allow:  GET,  PUT,  DELETE  
     
                     id="1234"  xl:type="simple"  xl:href="http://acme.com/products/1234">  
       Red  Stapler  
       3.14  
       false  

    API VERSION 2

    View Slide

  128. clients can’t upgrade protocol for known URLs!

    View Slide

  129. Also, imagine every install of phpBB or Drupal had an API

    View Slide

  130. If the version is in the URL, clients need to regex those

    View Slide

  131. http://sharksforum.org/community/api/v1/threads/102152

    View Slide

  132. http://forum.sharksforum.org/api/v1/threads/102152

    View Slide

  133. that would be fail

    View Slide

  134. or what if another forum software wants the same API?

    View Slide

  135. also would have to use “/v1/” in their URLs

    View Slide

  136. URI based versioning kills interoperability

    View Slide

  137. YOU MIGHT BE WONDERING
    Why Exactly Is This Awesome?

    View Slide

  138. THE MERITS OF REST
    • Easy to evolve: add new
    features or elements without
    breaking BC
    • Easy to learn: developers can
    "browse" service via link rels
    • Easy to scale up: grows well
    with number of features,
    users and servers
    • Easy to implement: build it
    on top of HTTP, and profit!
    • Authentication & TLS
    • Caching & Load Balancing
    • Conditional Requests
    • Content Negotiation

    View Slide

  139. but...

    View Slide

  140. hold on, you say

    View Slide

  141. a plain HTTP-loving service does the job, you say

    View Slide

  142. surely, there is a merit to REST beyond extensibility, you ask

    View Slide

  143. nope

    View Slide

  144. "REST is software design on the scale of decades: every
    detail is intended to promote software longevity and
    independent evolution. Many of the constraints are
    directly opposed to short-term efficiency. Unfortunately,
    people are fairly good at short-term design, and usually
    awful at long-term design."
    Roy Fielding

    View Slide

  145. "Most of REST's constraints are focused on preserving
    independent evolvability over time, which is only
    measurable on the scale of years. Most developers
    simply don't care what happens to their product years
    after it is deployed, or at least they expect to be around
    to rewrite it when such change occurs."
    Roy Fielding

    View Slide

  146. FURTHER READING
    • Leonard Richardson, Mike Amundsen, Sam Ruby

    RESTful Web APIs

    ISBN: 978-1449358068
    • Jim Webber, Savas Parastatidis & Ian Robinson

    How to GET a Cup of Coffee

    http://www.infoq.com/articles/webber-rest-workflow
    • Roy Thomas Fielding

    Architectural Styles and the Design of Network-based Software
    Architectures

    http://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm

    View Slide

  147. MORE BOOKS ON REST
    • Jim Webber, Savas Parastatidis, Ian Robinson

    REST in Practice

    ISBN: 978-0596805821
    • Subbu Allamaraju

    RESTful Web Services Cookbook

    ISBN: 978-0596801687
    • Leonard Richardson, Sam Ruby

    RESTful Web Services

    ISBN: 978-0596529260

    View Slide

  148. The End

    View Slide

  149. RESTFUL
    WEB SERVICES
    Thanks for listening! Contact:
    @dzuelke & [email protected]
    rate my talk
    on joind.in!

    View Slide