Download to read offline
![Simple Request • URL should be light and meaningful • Avoid unnecessary query string • Use basic HTTP request methods [GET, POST, PUT, PATCH, DELETE] based on API use case](https://image.slidesharecdn.com/restapidesigndevelop-190130061141/75/REST-Api-Design-Develop-9-2048.jpg)
![Secure Request • Authentication & Authorization • Token based authentication [e.g JWT] • Client must know the secret key to sign the token for persistent connection • Server will verify the signature by same key • If mismatched, request is unauthorized • Oath2 authentication & authorization • Register client identity in Authorization server firsthand • Request access token from Authorization server • Request resource server with the access token granted from Authorization server • Provide encrypted/encoded session token for persistent connection between user and server • Input filter handling • Cross-site scripting (XSS) protection • SQL-injection protection • SSL installation in server • Block IP of DDos attacker](https://image.slidesharecdn.com/restapidesigndevelop-190130061141/75/REST-Api-Design-Develop-10-2048.jpg)
![Appropriate response • Send response in correct format • JSON data as response • Avoid data redundancy • Avoid unwanted data { "result_code":0, "time":"2018-12-10 12:20:00", "data":{ "user":{ "id":4, "name":"Mr. X", "items":[ { "id":1, "name":"laptop", "count":1 }, { "id":2, "name":"monitor", "count":1 } ] } } }](https://image.slidesharecdn.com/restapidesigndevelop-190130061141/75/REST-Api-Design-Develop-13-2048.jpg)
Uploaded bySabbir Rupom
REST-Api Design & Develop
This document provides an overview of REST APIs and best practices for designing them. It defines REST as Representational State Transfer and describes RESTful APIs as receiving requests from clients over HTTP and responding based on the server state. Key points covered include using JSON for lightweight and readable responses, securing requests through authentication and authorization, optimizing performance through caching and non-blocking I/O, using status codes and result codes to inform clients, and properly documenting and versioning APIs.
REST-Api Design & Develop
- 1. A Road to {REST : API } Design & Develop Sabbir Hossain (Rupom) Web Developer https://sabbirrupom.com/
- 2. What is REST? RepresentationState Transfer !!!
- 3. A simple question betweentwo person How are you?
- 4. Someone is requestingfor an answer Other party is responding based on his state
- 5. So, what isa RESTful API? An application program interface (API) that receives a request from client (web/mobile application) and send a response based on the state of server over the HTTP protocol.
- 6. REST vs SOAP •REST performs better and faster than SOAP • Coupled with JSON, easily readable language by both human and machine • Though in some cases in data security and transaction reliability, SOAP performs better
- 7. What is JSON? •JavaScript Object Notation • Minimal, readable format for structuring data • An alternative for XML, more light weighted in nature • A key features of REST API response is JSON
- 8. REST API DesignArchitecture Key things to be noted Simple request Secure request Fast response Status code Appropriate response Secure response Documentation Console Versioning
- 9. Simple Request • URLshould be light and meaningful • Avoid unnecessary query string • Use basic HTTP request methods [GET, POST, PUT, PATCH, DELETE] based on API use case
- 10. Secure Request • Authentication& Authorization • Token based authentication [e.g JWT] • Client must know the secret key to sign the token for persistent connection • Server will verify the signature by same key • If mismatched, request is unauthorized • Oath2 authentication & authorization • Register client identity in Authorization server firsthand • Request access token from Authorization server • Request resource server with the access token granted from Authorization server • Provide encrypted/encoded session token for persistent connection between user and server • Input filter handling • Cross-site scripting (XSS) protection • SQL-injection protection • SSL installation in server • Block IP of DDos attacker
- 11. Fast response • Makebackend as light as possible • PHP Microframework (Slim, Lumen, Flight etc.) • Use Non-blocking I/O over blocking I/O • Express JS • Python Django • Cache server to store relatively non-dynamic and light weighted data for faster reading • Memcache / Radis • Backend code optimization
- 12. Status codes • Forecastthe client to be prepared which comes next • HTTP status codes • 1xx (Informational): The request was received, continuing process • 2xx (Successful): The request was successfully received, understood, and accepted • 3xx (Redirection): Further action needs to be taken in order to complete the request • 4xx (Client Error): The request contains bad syntax or cannot be fulfilled • 5xx (Server Error): The server failed to fulfill an apparently valid request • Result codes • Make client understand the state of requested result
- 13. Appropriate response • Sendresponse in correct format • JSON data as response • Avoid data redundancy • Avoid unwanted data { "result_code":0, "time":"2018-12-10 12:20:00", "data":{ "user":{ "id":4, "name":"Mr. X", "items":[ { "id":1, "name":"laptop", "count":1 }, { "id":2, "name":"monitor", "count":1 } ] } } }
- 14. Secure response • Maskingfile directory path with custom URL or Third party cloud storage path http://example.com/uploads/image/users/1.jpg http://example.com/image/user/1?ref=xxxxxxxxxx1 • Remove unnecessary response header to hide server information from exposing to threat
- 15. Documentation API must bewell documented
- 16. Console • A testingground for API request/response testing • Should be available to system developer/s and tester/s only • Tools • POSTMAN • Custom console tool
- 17. Versioning • Keep yourapi version up while major changes is on • Keep older api versions for old- not yet updated client users • Example: • http://host/v1/get_user_info?user_id=1 • http://host/v2/users/info/1
- 18. Code example • Acustom REST-API template can be found here • https://github.com/sabbir-rupom/rest-api-flight-PHP • Based on PHP-Flight microframework • Follow the documentation flow • Study the source architecture
- 19.