REST for the rest of us

I try to make sense of the Representation State Transfer architectural style introduced by Roy Fielding, one of the original authors of HTTP 1.1

Transcript

1. REST for the rest of us or “Roy Fielding Ever Said That!?” Antonio Ognio // Lima, Perú Red Científica Peruana @gnrfan
2. REST
3. REPRESENTATIONAL STATE TRANSFER
4. TRANSFERING STATE THROUGH REPRESENTATIONS?
5. STATE?
6. REPRESENTATIONS?
7. CONFUSING!!!
8. ROY T. FIELDING
9. MAKING SENSE OF IDEAS PRESENTED IN HIS DOCTORAL THESIS
12. http://www.ietf.org/rfc/rfc2616.txt
13. BASICALLY ONE OF THE AUTHORS OF HTTP/1.1 AND THE STANDARD FOR INTERNET URIs
15. REST IS NOT...
16. SOAP
17. MAPPING HTTP VERBS TO CRUD OPERATIONS
18. ANY FORM OF RPC OVER HTTP
19. REST IS...
20. AN ARCHITECTURAL STYLE FOR DISTRIBUTED SOFTWARE
21. ARCHITECTURAL STYLE
22. THE WAY THE WEB IS ARCHITECTED
23. IF YOU REALLY UNDERSTAND THE ARCHITECTURE OF THE WEB...
24. ...YOU ALREADY UNDERSTAND REST :)
25. IN THE 90s... THE WEB EVOLVED
26. ...FROM SERVING STATIC FILES OUT OF WEB SERVERS’ HARD DRIVES
27. ...TO BECOMING AN UNIVERSAL INFRASTRUCTURE FOR MANIPULATING THINGS OVER PLANET-WIDE HIGH- LATENCY NETWORKS
28. HTTP 1.1 (1999)
29. HTTP 1.1 (1999) STILL IN USE TODAY
31. CGI, Servlets, mod_*, web frameworks, customizable- web servers, etc..
32. 2013: REALLY EASY TO GENERATE DYNAMIC WEB CONTENT USING CLEAN URLs
33. HOW WAS REST INVENTED?
34. REST WAS REVERSE-ENGINEERED BY FIELDING FROM THE DESIGN OF THE WEB
35. ARCHITECTURAL STYLE?
36. set of constraints that restricts the roles/features of architectural elements
37. architectural elements: components, connectors and data
38. TOO ACADEMIC?
39. A RECIPE FOR REST
40. A RECIPE FOR REST IN FOUR STEPS
41. IDENTIFY THE “THINGS” IN YOUR PROBLEM SPACE AND GIVE THE UNIQUE IDs 1
42. URIs
43. LINK THE “THINGS” TOGETHER SO YOU CAN NAVIGATE FROM ONE TO THE OTHERS 2
44. HYPERMEDIA
45. PROVIDE A WELL-KNOWN WAY OF MUNIPULATING THE “THINGS” 3
46. STANDARD HTTP VERBS
47. DON’T REQUIRE A PIECE OF THE SYSTEM TO “REMEMBER” THE STATE OF ANOTHER 4
48. STATELESS COMMUNICATION
49. WHY REST?
50. BECAUSE LARGE-SCALE DISTRIBUTED SYSTEMS ARE HARD
51. AND THE WEB IS BY FAR THE MOST SUCCESSFUL OF THOSE
52. ...SO LET’S LEARN FROM ITS DESIGN
53. REST emphazsizes
54. SCALABILITY
55. GENERALITY OF INTERFACES
56. INDEPENDENT DEPLOYMENT OF COMPONENTS
57. THE USE OF MIDDLEWARE (e.g. reducing latency, security)
58. architectural elements: components, connectors and data
62. USE THE WHOLE RANGE OF WEB-RELATED TECHNOLOGIES FOR BUILDING YOUR SYSTEM
63. KEY CONCEPTS
64. RESOURCE
65. RESOURCE UNIQUELY IDENTIFIED BY AN URI
66. REPRESENTATION
67. REPRESENTATION SPECIFIC DOCUMENT INSTANCE OF A MEDIA TYPE REPRESENTING THE CURRENT STATE OF A RESOURCE
68. VERB
69. VERB A KIND OF ACTION TO PERFORM OVER A RESOURCE THAT CAN POTENTIALLY ALTER THE STATE OF THE SYSTEM
70. HTTP’S UNIFORM INTERFACE
71. GET RETRIEVE A REPRESENTATION OF THE CURRENT STATE OF A RESOURCE
72. HEAD RETRIEVE ONLY THE HEADERS OF A REPRESENTATION OF THE CURRENT STATE OF A RESOURCE
73. POST SEND INFORMATION FOR THE RESOURCE TO PROCESS
74. PUT REPLACE THE CURRENT STATE OF A RESOURCE BASED ON A COMPLETE REPRESENTATION
75. DELETE GET RID OF THE RESOURCE
76. OPTIONS LEARN ABOUT WHAT VERBS ARE SUPPORTED FOR THE RESOURCE
78. STATUS CODES
79. 200 OK HERE IS THE REPRESENTATION OF THE RESOURCE YOU ASKED FOR
80. 201 CREATED A NEW RESOURCE HAS BEEN CREATED AND HERE IS A LINK TO IT
81. 202 ACCEPTED THE OPERATION YOU REQUESTED HAS BEEN ACCEPTED FOR PROCESSING. PLEASE POLL THE LINKED RESOURCE TO LEARN ABOUT THE PROGRESS.
82. 204 NO CONTENT THE OPERATION WAS COMPLETED SUCCESSFULLY AND DON’T WORRY ABOUT THE BODY BEING BLANK
83. 400 BAD REQUEST DON’T EVEN BOTHER RETRYING WITH THE EXACT SAME REQUEST BECAUSE IT WON’T WORK
84. 401 UNAUTHORIZED PLEASE, AUTHENTICATE SO WE CAN TELL IF YOU ARE AUTHORIZED OR NOT TO ACCESS THE RESOURCE
85. 403 FORBIDDEN SORRY, WE JUST CHECKED AND YOU DON’T HAVE ACCESS TO THE RESOURCE
86. 404 NOT FOUND THE RESOURCE LOCATED AT THE PROVIDED URI DOES NOT EXISTS (AT LEAST FOR YOU)
87. 405 METHOD NOT ALLOWED THE RESOURCE DOES NOT SUPPORT THE VERB YOU ARE TRYING TO USE AGAINST IT
88. 406 NOT ACCEPTABLE SORRY, WE CAN’T PROVIDE A REPRESENTATION FOR THE RESOURCE USING ANY OF THE MEDIA TYPES YOU ACCEPT
89. 409 CONFLICT SORRY, THERE IS A CONFLICT WITH THE CURRENT STATE OF THE RESOURCE AND THE NEW STATE IT WOULD HAVE IF WE PERFORM THE REQUESTED OPERATION
90. Quick guide to HTTP status codes: http://httpstatus.es
91. RESTFUL HTTP APIs
92. RESTFUL HTTP APIs Web services that take full advantage of an specific incarnation of REST (HTTP) and it’s full ecosystem
93. WHO IS DOING IT RIGHT?
94. Text http://developer.github.com/
96. Github HTTP APIs use: - Their own media types - JSON-based hypermedia - Full URIs to every resource - Home documents with links - Useful metadata in the headers
97. Github also provides: - Connectors: Client libraries for many languages - Components: Desktop and mobile-based user agents for different platforms
98. “PRAGMATIC” REST?
99. “Pragmatic REST”: - Don’t use custom media types - Don’t include full URIs of resources - Don’t use home documents - Don’t include metadata as headers
100. DON’T
101. BROKEN REST
102. NOT REST AT ALL
103. DON’T CALL THAT REST
104. GET YOUR OWN BUZZWORD
105. HOW TO PROTECT YOUR HTTP API?
106. SSL ALONE WON’T DO!!!
107. LEARN ABOUT THE BREACH VULNERABILITY
108. USE ONE-TIME PASSWORDS
110. LEARN ABOUT DIGEST AUTHENTICATION
111. SEND A NONCE WITH EVERY REQUEST
112. PROTECT FROM REPLAY ATTACKS
113. READ RFC 2616 HTTP
114. READ RFC 2617 HTTP AUTHENTICATION
115. READ RFCs 4226 / 6238 HMAC/TIME-BASED OTPs
116. REST IS THE WEB
117. REST IS THE WEB JUST USE IT
118. PLEASE DON’T REINVENT SQUARE-SHAPED WHEELS!!!
119. REST for the rest of us or “Roy Fielding Ever Said That!?” Antonio Ognio // Lima, Perú Red Científica Peruana @gnrfan