I refer many document for trying making api Restful like below:
GET /user
POST /user
GET /user/123
PUT /user/123
DELETE /uesr/123
But Backend uses OAuth2 token to retrieve user id, it means that Server will know 123 after get token.
I thought it's not a great idea to put token directly in the id place:
GET /user/aweakleknf11123232sadwanawndajkdnamdal
Is any better practice to the restful OAuth2 API?
While designing RESTful api don't think too much about how your url look, rather it is just representation of your resources.
And moreover it is not good idea to expose domain model of your project if your api is public.
If you have gone through Facebook api design you can see that they refer user as
/me?method=GET&format=json&access_token=...
They have abstracted the domain and just sharing self descriptive representation.
Related
I want to create REST login/registration URI in order to make a an existing user login or a new user to register. After a little search I found that most of such forms are designed using the following rules:
GET /login to get the login resource
POST /login to login and get back the user profile resource
GET /register to get the registration resource
POST /register to register and get back the new user profile resource
However, I think that this is not a 100% REST approach as one of the rules of REST is that resources should be nouns and not verbs (except from some special cases like a search api). What's the best solution for such a situation ?
There's no one right answer to this, so I'll attempt to give some ideas on a common ways to solve this.
Login
Login (aka Authentication) itself is typically handled in a non RESTful way, ourside, such as OAuth2. Should there really be a 'login' if HTTP is stateless? Every request should carry all the information to allow a server to authenticate the client. If you do want to really handle login as a RESTful endpoint, you could ask yourself: "What state am I changing? One way to answer this is that maybe you a creating a set of credentials". I'm assuming for now that you are looking for a best practice / common approach to this though, and not a very purist REST approach for this.
Current user information
Getting the current user is often handled via an endpoint such as /current-user or /whoami. Doing a GET request on this could either yield information about the user, or it could immediately redirect to a canonical user endpoint such as /users/1234. Executing a PUT request could again either update the user, or return a redirect to the actual user endpoint.
Registration
If you have a list of users on a resource like /users. It would kind of make sense to create a new user resource by doing a POST request on this collection.
I did a research on this topic, but I still cannot find any answer.
I'm trying to use oauth2 and jwt to implement a web login function, then I need a rest style api between backend and frontend.
10 years ago, people just use ..../login to deal with it, but Restful api suggest that there is no verb in the url. So some people suggest that we can use ....../accesstoken, then POST username and password to get a token.
However, I think if we consider an accesstoken as resource, when we want to get the accesstoken, we should use GET method, isn't it?
So my question is: What is the best practice when designing a restful style url for login? Or just restful api is unable to achieve that?
Thanks!
===updated===
in spring oauth2, the default url it provide is post grant_type and relative info to the url /oauth/token. But shoud we use GET method to get resource?
I think "/login" should be ok. In the book, REST API Design Rulebook, here is a paragraph said "Like a traditional web application's use of HTML forms, a REST API relies on controller resources to perform application-specific actions that cannot be logically mapped to one of the standard method (CRUD)." which means the application-specific action, login can be seen as a controller resource. Since controllers are executed by POST method, the final resource can be presented as "POST foo.com/api/login".
The example given in the book is a controller resource that allows a client to resend an alert to a user: POST /alerts/245743/resend
Facebook has an API to get your photos:
GET graph.facebook.com
/me/photos
/me/ is a shortcut for the Id of the person logged in. Is that introducing state into the session and therefore is it restful?
Would it not be more restful to do:
/user/1234/photos
and then have some security layer to make sure only users with the appropriate token can access that URL?
https://developers.facebook.com/docs/graph-api/using-graph-api
Noticing some other places use this pattern. For example:
Stripe do this for GET all coupons:
GET https://api.stripe.com/v1/coupons
Paypal do this for all payments:
GET /v1/payments/payment
https://developer.paypal.com/docs/api/payments/
GraphQL is not restful, I tried to sum this up here.
The /me does not necessarily introduce state, because the id for me could be in the headers, so the serverside can still be stateless.
Is that introducing state into the session and therefore is it
restful?
In fact statelessness is a constraint for rest, so you would have to rephrase your question to "... therefore is it not restful"
But REST relies heavily on URIs, so this shortcut circumvents being transparent in the URI, what is not the best idea according to restful principles.
REST IS a concept/approach/way to provide interoperability between computer systems.
REST IS NOT a standard, approved by a committee/organization in terms of strict regulations.
While there are architectural constraints, recommendations, unwritten rules, common solutions, you can't truly affirm this is rest or this is not rest. Everyone design its service as he thinks it's better.
Graph API is not exactly REST, they are a bit just different things/meanings.
Related to FB /me they said:
The /me node is a special endpoint that translates to the user_id of
the person (or the page_id of the Facebook Page) whose access token is
currently being used to make the API calls.
As this URI depends on authenticated user, what's the problem with it?
Related to PayPal, I think You prefer /v1/payments/payment instead of /v1/payments/35/payment, but the same app deployed to another customer will be /v1/payments/69/payment or a logout like /v1/user/35/logout.
It's all about convenience.
I am writing REST APIs in a MEAN application for user management. Although I normally follow best practices for REST APIs, I do have a security concern about exposing too much detail for user accounts API in the URI.
I would prefer not to include the username or account ID as part of the URI when trying to access a specific user account resource:
/api/accounts/:id or /api/accounts/:username
The one alternate approach I have come across is the use of "me" instead of the resource id:
/api/accounts/me
Most of the use cases I have seen only use GET, but I would like to use this for PUT/POST operations as well:
PUT /api/accounts/me/password
{"oldPassword":"xxx", "newPassword":"yyy"}
Do you think this is a good way? Any other ideas?
I'm creating restful api that is used by angular web page. I'm using token based authentication. Server side determines which user sent request based on token value, so I don't have to pass user id on URI. For example, request that returns all orders for logged (with token) user looks like this:
/api/orders
instead of:
/api/users/123/orders
Api is still stateless, but the same URI returns different data depending on headers. Is it consistent with Restful principles?
I think that this suggested API violates the address-ability feature of REST. The address of a resource should be in a form that is visible and readable (and some other things not related to your question...). One of the nice things of nice URIs is that one can link to it easily. Headers are actually hiding the real address of the resource hence making it impossible to link to it. So bottom line I would not go for such an API.