Security of REST authentication schemes

A previous answer only mentioned SSL in the context of data transfer and didn’t actually cover authentication. You’re really asking about securely authenticating REST API clients. Unless you’re using TLS client authentication, SSL alone is NOT a viable authentication mechanism for a REST API. SSL without client authc only authenticates the server, which is irrelevant … Read more

Transactions across REST microservices?

What doesn’t make sense: distributed transactions with REST services. REST services by definition are stateless, so they should not be participants in a transactional boundary that spans more than one service. Your user registration use case scenario makes sense, but the design with REST microservices to create User and Wallet data is not good. What … Read more

REST vs JSON-RPC? [closed]

The fundamental problem with RPC is coupling. RPC clients become tightly coupled to service implementation in several ways and it becomes very hard to change service implementation without breaking clients: Clients are required to know procedure names; Procedure parameters order, types and count matters. It’s not that easy to change procedure signatures(number of arguments, order … Read more

‘Best’ practice for restful POST response

Returning the new object fits with the REST principle of “Uniform Interface – Manipulation of resources through representations.” The complete object is the representation of the new state of the object that was created. There is a really excellent reference for API design, here: Best Practices for Designing a Pragmatic RESTful API It includes an … Read more

How to create REST URLs without verbs?

General principles for good URI design: Don’t use query parameters to alter state Don’t use mixed-case paths if you can help it; lowercase is best Don’t use implementation-specific extensions in your URIs (.php, .py, .pl, etc.) Don’t fall into RPC with your URIs Do limit your URI space as much as possible Do keep path … Read more

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)