Designing HTTP Interfaces and RESTful Web Services

Presentation given at International PHP Conference 2014 in Munich, Germany.

Transcript

1. DESIGNING HTTP INTERFACES AND RESTFUL WEB SERVICES
2. David Zuelke
4. dz@heroku.com
5. @dzuelke
6. THE OLDEN DAYS Before REST was En Vogue
7. http://www.acme.com/index.php?action=zomg&page=lol
8. along came
9. K dis is srs SEO
10. and said
11. NEIN NEIN NEIN NEIN DAS IST VERBOTEN
12. at least if they were
14. so we had to make URLs "SEO friendly"
15. http://www.acme.com/zomg/lol
16. and then things got out of control
17. because nobody really had a clue
18. http://acme.com/videos/latest/hamburgers
19. http://acme.com/search/lolcats/pictures/yes/1/200
20. oh dear…
21. THE RISE OF WEB SERVICES Ohai, I'm ur CEO, I canhaz SOAP API plz, today, kthx?
22. POST  /soapendpoint.php  HTTP/1.1   Host:  localhost   Content-­‐Type:  text/xml;  charset=utf-­‐8   ! <?xml  version="1.0"  encoding="UTF-­‐8"?>   <SOAP-­‐ENV:Envelope  xmlns:SOAP-­‐ENV="http://schemas.xmlsoap.org/soap/envelope/">      <SOAP-­‐ENV:Body>          <ns1:getProduct  xmlns:ns1="http://agavi.org/sampleapp">              <id>123456</id>          </ns1:getProduct>      </SOAP-­‐ENV:Body>   </SOAP-­‐ENV:Envelope> HTTP/1.1  200  OK   Content-­‐Type:  text/xml;  charset=utf-­‐8   ! <?xml  version="1.0"  encoding="UTF-­‐8"?>   <SOAP-­‐ENV:Envelope  xmlns:SOAP-­‐ENV="http://schemas.xmlsoap.org/soap/envelope/">      <SOAP-­‐ENV:Body>          <ns1:getProductResponse  xmlns:ns1="http://agavi.org/sampleapp">              <product>                  <id>123456</id>                  <name>Red  Stapler</name>                  <price>3.14</price>              </product>          </ns1:getProductResponse>      </SOAP-­‐ENV:Body>   </SOAP-­‐ENV:Envelope>
23. POST  /soapendpoint.php  HTTP/1.1   Host:  localhost   Content-­‐Type:  text/xml;  charset=utf-­‐8   ! <?xml  version="1.0"  encoding="UTF-­‐8"?>   <SOAP-­‐ENV:Envelope  xmlns:SOAP-­‐ENV="http://schemas.xmlsoap.org/soap/envelope/">      <SOAP-­‐ENV:Body>          <ns1:getProduct  xmlns:ns1="http://agavi.org/sampleapp">              <id>987654</id>          </ns1:getProduct>      </SOAP-­‐ENV:Body>   </SOAP-­‐ENV:Envelope> HTTP/1.1  500  Internal  Service  Error   Content-­‐Type:  text/xml;  charset=utf-­‐8   ! <?xml  version="1.0"  encoding="UTF-­‐8"?>   <SOAP-­‐ENV:Envelope  xmlns:SOAP-­‐ENV="http://schemas.xmlsoap.org/soap/envelope/">      <SOAP-­‐ENV:Body>          <SOAP-­‐ENV:Fault>              <faultcode>SOAP-­‐ENV:Server</faultcode>              <faultstring>Unknown  Product  </faultstring>          </SOAP-­‐ENV:Fault>      </SOAP-­‐ENV:Body>   </SOAP-­‐ENV:Envelope>
24. SOAP sucks, said everyone
25. let's build APIs without the clutter, they said
26. example: the old http://joind.in/ API
27. POST  /api/talk  HTTP/1.1   Host:  joind.in   Content-­‐Type:  text/xml;  charset=utf-­‐8   ! <?xml  version="1.0"  encoding="UTF-­‐8"?>   <request>                  <auth>                                  <user>Chuck  Norris</user>                                  <pass>roundhousekick</pass>                  </auth>                  <action  type="getdetail">                                  <talk_id>42</talk_id>                  </action>   </request> HTTP/1.1  200  OK   Content-­‐Type:  text/xml;  charset=utf-­‐8   ! <?xml  version="1.0"  encoding="UTF-­‐8"?>   <response>     <item>       <talk_title>My  Test  Talk</talk_title>       <talk_desc>This  is  a  sample  talk  description</talk_desc>       <ID>42</ID>     </item>   </response>
28. PROBLEMS WITH THIS API • Always a POST • Doesn't use HTTP Authentication • Operation information is enclosed in the request ("getdetail") • Nothing there is cacheable • Everything through one endpoint (/api/talks for talks)
29. Level 0 in the Richardson Maturity Model: Plain old XML over the wire in an RPC fashion
30. Room for improvement: use one URI for each resource “ “
31. That would be Level 1 in Richardson's Maturity Model
32. Level 0 and Level 1 are a bag of hurt. Do not use them. Ever.
33. ALONG CAME ROY FIELDING And Gave Us REST
34. that was awesome
35. because everyone could say
36. J I haz REST nao
37. when in fact
38. they absolutely didn’t
39. REST What Does That Even Mean?
40. REpresentational State Transfer
41. Roy Thomas Fielding: Architectural styles and the design of network based software architectures.
42. • Client-Server • Stateless • Cacheable • Layered System • Code on Demand (optional) • Uniform Interface REST CONSTRAINTS
43. • A URL identifies a Resource • Methods perform operations on resources • The operation is implicit and not part of the URL • A hypermedia format is used to represent the data • Link relations are used to navigate a service UNIFORM INTERFACE
44. a web page is not a resource
45. it is a (complete) representation of a resource
46. GET  /products/  HTTP/1.1   Host:  acme.com   Accept:  application/json HTTP/1.1  200  OK
 Content-­‐Type:  application/json;  charset=utf-­‐8   Allow:  GET,  POST   ! [      {          id:  1234,          name:  "Red  Stapler",          price:  3.14,          location:  "http://acme.com/products/1234"      }   ] GETTING JSON BACK
47. GET  /products/  HTTP/1.1   Host:  acme.com   Accept:  application/xml HTTP/1.1  200  OK   Content-­‐Type:  application/xml;  charset=utf-­‐8   Allow:  GET,  POST   ! <?xml  version="1.0"  encoding="utf-­‐8"?>   <products  xmlns="urn:com.acme.products"  xmlns:xl="http://www.w3.org/1999/xlink">      <product  id="1234"  xl:type="simple"  xl:href="http://acme.com/products/1234">          <name>Red  Stapler</name>          <price  currency="EUR">3.14</price>      </product>   </products> GETTING XML BACK
48. but those are not hypermedia formats!
49. (more on that a bit later)
50. GET  /products/  HTTP/1.1   Host:  acme.com   Accept:  application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,*/*;q=0.5   User-­‐Agent:  Mozilla/5.0  (Macintosh;  U;  Intel  Mac  OS  X  10_5_8;  en-­‐us)  AppleWebKit… HTTP/1.1  200  OK   Content-­‐Type:  text/html;  charset=utf-­‐8   Allow:  GET,  POST   ! <html  lang="en">      <head>          <meta  http-­‐equiv="Content-­‐Type"  content="text/html;  charset=UTF-­‐8"></meta>          <title>ACME  Inc.  Products</title>      </head>      <body>          <h1>Our  Incredible  Products</h1>          <ul  id="products">              <li><a  href="http://acme.com/products/1234">Red  Stapler</a>  (€3.14)</li>          </ul>      </body>   </html> AND FINALLY, HTML
51. VOLUME ONE Designing an HTTP Interface
52. FIRST: DEFINE RESOURCES A Good Approach: Structure Your URLs
53. "BAD URLS" • http://www.acme.com/product/ • http://www.acme.com/product/filter/cats/desc • http://www.acme.com/product/1234 • http://www.acme.com/photos/product/1234 • http://www.acme.com/photos/product/1234/new • http://www.acme.com/photos/product/1234/5678 WTF? photo or product ID? new what?
54. "GOOD URLS" • http://www.acme.com/products/ • http://www.acme.com/products/?filter=cats&sort=desc • http://www.acme.com/products/1234 • http://www.acme.com/products/1234/photos/ • http://www.acme.com/products/1234/photos/?sort=latest • http://www.acme.com/products/1234/photos/5678 a list of products filtering is a query a single product all photos
55. now here's the ironic part
56. URLs don't matter once you have a fully RESTful interface
57. but it’s helpful to think in terms of resources
58. SECOND: USE RESOURCES CRUD, but not really
59. COLLECTION OPERATIONS • http://www.acme.com/products/ • GET to retrieve a list of products • POST to create a new product • returns • 201 Created • Location: http://www.acme.com/products/1235
60. ITEM OPERATIONS • http://www.acme.com/products/1234 • GET to retrieve • PUT to update • DELETE to, you guessed it, delete
61. and remember
62. don't let the server maintain client state (e.g. cookies)
63. Now we are at Level 2 in RMM
64. RMM LEVEL 2 • Use HTTP verbs • GET (safe and idempotent) • POST (unsafe, not idempotent) • PUT & DELETE (unsafe, idempotent) • Use HTTP status codes to indicate result success • e.g. HTTP/1.1 409 Conflict
65. THE TWITTER (V1) API Not RESTful, And Not Even Getting HTTP Right :(
66. mind you we're not even inspecting the RESTfulness
67. we're just looking at Twitter's API from an HTTP perspective
68. CURRENT STATE • GET http://api.twitter.com/1/statuses/show/12345.json • POST http://api.twitter.com/1/statuses/update.json • DELETE http://api.twitter.com/1/statuses/destroy/12345.json • GET http://api.twitter.com/1/statuses/retweets/12345.json • PUT http://api.twitter.com/1/statuses/retweet/12345.json Doesn’t allow Accept header Why a PUT? Why the difference? Posts to auth’d user! “DELETE destroy”, RPC much?
69. COULD BE SO MUCH SIMPLER • http://twitter.com/username/statuses/ • POST to create a new tweet • http://twitter.com/username/statuses/12345 • DELETE deletes (PUT could be used for updates) • http://twitter.com/username/statuses/12345/retweets/ • POST creates a new retweet
70. INTERMISSION What's the Biggest Reason for the Success of the Web?
71. WWW
72. first information exchange system
73. planetary scale
76. why is that possible?
77. Hyperlinks!
78. no tight coupling!
79. loosely coupled by design
80. no notification infrastructure
81. HTTP/1.1 404 Not Found
82. embraces failure
83. more information != more friction
84. no limits to scalability
85. WWW is protocol-centric
86. VOLUME TWO RESTful Services with Hypermedia
87. THE UNIFORM INTERFACE • Identification of Resources (e.g. through URIs) • Representations are conceptually separate! • Manipulation Through Representations (i.e. they are complete) • Self-Descriptive Messages (containing all information) • Hypermedia As The Engine Of Application State ("HATEOAS") magic awesomesauce essential to REST
88. HATEOAS The Missing Piece in the Puzzle
89. ONE LAST PIECE IS MISSING • How does a client know what to do with representations? • How do you go to the “next” operation? • What are the URLs for creating subordinate resources? • Where is the contract for the service?
90. HYPERMEDIA AS THE ENGINE OF APPLICATION STATE • Use links to allow clients to discover locations and operations • Link relations are used to express the possible options • Clients do not need to know URLs, so they can change • The entire application workflow is abstracted, thus changeable • The hypermedia type itself could be versioned if necessary • No breaking of clients if the implementation is updated!
91. (X)HTML and Atom are Hypermedia formats
92. Or you roll your own...
93. GET  /products/1234  HTTP/1.1   Host:  acme.com   Accept:  application/vnd.com.acme.shop+xml HTTP/1.1  200  OK   Content-­‐Type:  application/vnd.come.acme.shop+xml;  charset=utf-­‐8   Allow:  GET,  PUT,  DELETE   ! <?xml  version="1.0"  encoding="utf-­‐8"?>   <product  xmlns="urn:com.acme.prods"  xmlns:atom="http://www.w3.org/2005/Atom">      <id>1234</id>      <name>Red  Stapler</name>      <price  currency="EUR">3.14</price>
    <atom:link  rel="payment"  type="application/vnd.com.acme.shop+xml"                            href="http://acme.com/products/1234/payment"/>   </product> re-use Atom for
 link relations meaning defined in IANA Link Relations list A CUSTOM MEDIA TYPE Remind clients of Uniform Interface :)
94. boom, RMM Level 3
95. XML is really good for hypermedia formats
96. (hyperlinks, namespaced attributes, re-use of formats, …)
97. JSON is more difficult
98. (no hyperlinks, no namespaces, no element attributes)
99. <?xml  version="1.0"  encoding="utf-­‐8"?>   <product  xmlns="urn:com.acme.prods"  xmlns:atom="http://www.w3.org/2005/xlink">      <id>1234</id>      <name>Red  Stapler</name>      <atom:link  rel="payment"  type="application/com.acme.shop+xml"                            href="http://acme.com/products/1234/payment"/>      <price>3.14</price>
 </product> {      id:  1234,      name:  "Red  Stapler",      links:  [          {              rel:  "payment",              type:  "application/vnd.com.acme.shop+json",              href:  "http://acme.com/products/1234/payment"          }      ],      price:  3.14   } XML VERSUS JSON
100. <?xml  version="1.0"  encoding="utf-­‐8"?>   <product  xmlns="urn:com.acme.prods"  xmlns:atom="http://www.w3.org/2005/xlink">      <id>1234</id>      <name>Red  Stapler</name>      <atom:link  rel="payment"  type="application/com.acme.shop+xml"                            href="http://acme.com/products/1234/payment"/>      <price  currency="EUR">3.14</price>
 </product> {      id:  1234,      name:  "Red  Stapler",      links:  [          {              rel:  "payment",              type:  "application/vnd.com.acme.shop+json",              href:  "http://acme.com/products/1234/payment"          }      ],      price:  {          amount:  3.14,          currency:  "EUR"      }   } XML VERSUS JSON Content (“node value”) still the same Float becomes object, stuff breaks
101. JSON is difficult to evolve without breaking clients
102. XML’s document model is built for extensibility
103. <?xml  version="1.0"  encoding="utf-­‐8"?>   <products  xmlns="http://acme.com/shop/products">      <product  id="123">          <name>Bacon</name>          <price>5.99</price>      </product>   </products>   !
104. <?xml  version="1.0"  encoding="utf-­‐8"?>   <products  xmlns="http://acme.com/shop/products">      <product  id="123">          <name>Bacon</name>          <price>5.99</price>          OMNOMNOM  Bacon      </product>   </products>  
105. <?xml  version="1.0"  encoding="utf-­‐8"?>   <products  xmlns="http://acme.com/shop/products">      <product  id="123">          <name>Bacon</name>          <price  currency="USD">5.99</price>      </product>   </products>   !
106. <?xml  version="1.0"  encoding="utf-­‐8"?>   <products  xmlns="http://acme.com/shop/products">      <product  id="123">          <name>Bacon</name>          <price  currency="USD">5.99</price>          <price  currency="EUR">4.49</price>      </product>   </products>  
107. <?xml  version="1.0"  encoding="utf-­‐8"?>   <products  xmlns="http://acme.com/shop/products">      <product  id="123">          <name  xml:lang="en">Bacon</name>          <name  xml:lang="de">Speck</name>          <price  currency="USD">5.99</price>          <price  currency="EUR">4.49</price>      </product>   </products>
108. <?xml  version="1.0"  encoding="utf-­‐8"?>   <products  xmlns="http://acme.com/shop/products">      <product  id="123">          <name  xml:lang="en">Bacon</name>          <name  xml:lang="de">Speck</name>          <price>5.99</price>          <link  rel="category"  href="..."  />      </product>   </products>
109. and hey
110. without hypermedia, your HTTP interface is not RESTful
111. that’s totally fine
 and sometimes even the only way to do it
112. (e.g. CouchDB or S3 are never going to be RESTful)
113. just avoid calling it a "REST API" :)
114. good hypermedia format example: the Lovefilm API
115. <?xml  version="1.0"  encoding="utf-­‐8"  standalone="yes"?>   <search>      <total_results>6</total_results>      <items_per_page>1</items_per_page>      <start_index>1</start_index>      <link  href="http://openapi.lovefilm.com/catalog/games?start_index=1&amp;items_per_page=1&amp;term=old"                  rel="self"  title="self"/>      <link  href="http://openapi.lovefilm.com/catalog/games?start_index=2&amp;items_per_page=1&amp;term=old"                  rel="next"  title="next"/>      <link  href="http://openapi.lovefilm.com/catalog/games?start_index=6&amp;items_per_page=1&amp;term=old"                  rel="last"  title="last"/>      <catalog_title>          <can_rent>true</can_rent>          <release_date>2003-­‐09-­‐12</release_date>          <title  full="Star  Wars:  Knights  of  the  Old  Republic"  clean="Star  Wars:  Knights  of  the  Old  Republic"/>          <id>http://openapi.lovefilm.com/catalog/title/59643</id>          <adult>false</adult>          <number_of_ratings>574</number_of_ratings>          <rating>4</rating>          <category  scheme="http://openapi.lovefilm.com/categories/catalog"  term="games"/>          <category  scheme="http://openapi.lovefilm.com/categories/format"  term="Xbox"/>          <category  scheme="http://openapi.lovefilm.com/categories/genres"  term="Adventure"/>          <category  scheme="http://openapi.lovefilm.com/categories/genres"  term="Role-­‐playing"/>          <category  scheme="http://openapi.lovefilm.com/categories/certificates/bbfc"  term="TBC"/>          <link  href="http://openapi.lovefilm.com/catalog/title/59643/synopsis"                      rel="http://schemas.lovefilm.com/synopsis"  title="synopsis"/>          <link  href="http://openapi.lovefilm.com/catalog/title/59643/reviews"                      rel="http://schemas.lovefilm.com/reviews"  title="reviews"/>          <link  href="http://www.lovefilm.com/product/59643-­‐Star-­‐Wars-­‐Knights-­‐of-­‐the-­‐Old-­‐Republic.html?cid=LFAPI"                      rel="alternate"  title="web  page"/>      </catalog_title>   </search>
116. ROOM FOR IMPROVEMENT IN THE LOVEFILM API • Uses application/xml instead of a custom media type • Once that is fixed, all the link elements could also have a “type” attribute indicating the media type • Should use XML namespaces on the root element, with one namespace per type (e.g. “urn:com.lovefilm.api.item”, “urn:com.lovefilm.api.searchresult” and so on) • That way, clients can determine the resource type easily
117. another great RESTful API: Huddle
118. <document      xmlns="http://schema.huddle.net/2011/02/"      title="TPS  report  May  2010"      description="relentlessly  mundane  and  enervating.">            <link  rel="self"  href="..."  />      <link  rel="parent"  href="..."  title="..."/>      <link  rel="edit"  href="..."  />      <link  rel="delete"  href="..."  />      <link  rel="content"  href="..."  title="..."  type="..."  />      <link  rel="thumb"  href="..."  />      <link  rel="version-­‐history"  href="..."  />      <link  rel="create-­‐version"  href="..."  />      <link  rel="comments"  href="..."  />            <actor  name="Peter  Gibson"  rel="owner">          <link  rel="self"  href="..."  />          <link  rel="avatar"  href="..."  type="image/jpg"  />          <link  rel="alternate"  href="..."  type="text/html"  />      </actor>            <actor  name="Barry  Potter"  rel="updated-­‐by">          <link  rel="self"  href="..."  />          <link  rel="avatar"  href="..."  type="image/jpg"  />          <link  rel="alternate"  href="..."  type="text/html"  />      </actor>            <size>19475</size>            <version>98</version>      <created>2007-­‐10-­‐10T09:02:17Z</created>      <updated>2011-­‐10-­‐10T09:02:17Z</updated>      <processingStatus>Complete</processingStatus>      <views>9</views>   </document>
119. ROOM FOR IMPROVEMENT IN THE HUDDLE API • Uses custom rels like “thumb” or “avatar” not defined in the IANA registry (http://www.iana.org/assignments/link-relations) • Risk of collisions and ambiguity; should use something like “http://rels.huddle.net/thumb” instead. • Uses one global XML schema and namespace for all entities • Clients cannot detect entity type based on namespace • Difficult to evolve schema versions independently
120. API VERSIONING Media Types To The Rescue!
121. why not api.myservice.com/v1/foo/bar? and then api.myservice.com/v2/foo/bar?
122. different URLs means different resources!
123. also, keep bookmarks (by machines) in mind
124. GET  /products/1234  HTTP/1.1   Host:  acme.com   Accept:  application/vnd.com.myservice+xml HTTP/1.1  200  OK   Content-­‐Type:  application/vnd.com.myservice+xml;  charset=utf-­‐8   Allow:  GET,  PUT,  DELETE   ! <?xml  version="1.0"  encoding="utf-­‐8"?>   <product  xmlns="urn:com.acme.products"  xmlns:xl="http://www.w3.org/1999/xlink"                      id="1234"  xl:type="simple"  xl:href="http://acme.com/products/1234">      <name>Red  Stapler</name>      <price  currency="EUR">3.14</price>   </product> API VERSION 1
125. (item sells out...)
126. GET  /products/1234  HTTP/1.1   Host:  acme.com   Accept:  application/vnd.com.myservice+xml HTTP/1.1  410  Gone   Content-­‐Type:  application/vnd.com.myservice+xml;  charset=utf-­‐8 API VERSION 1
127. API now offers a new protocol version with availability indicators (breaking change!)
128. GET  /products/1234  HTTP/1.1   Host:  acme.com   Accept:  application/vnd.com.myservice.v2+xml HTTP/1.1  200  OK   Content-­‐Type:  application/vnd.com.myservice.v2+xml;  charset=utf-­‐8   Allow:  GET,  PUT,  DELETE   ! <?xml  version="1.0"  encoding="utf-­‐8"?>   <product  xmlns="urn:com.acme.products"  xmlns:xl="http://www.w3.org/1999/xlink"                    id="1234"  xl:type="simple"  xl:href="http://acme.com/products/1234">      <name>Red  Stapler</name>      <price  currency="EUR">3.14</price>      <availability>false</availability>   </product> API VERSION 2
129. clients can’t upgrade protocol for known URLs!
130. Also, imagine every install of phpBB or Drupal had an API
131. If the version is in the URL, clients need to regex those
132. http://sharksforum.org/community/api/v1/threads/102152
133. http://forum.sharksforum.org/api/v1/threads/102152
134. that would be fail
135. or what if another forum software wants the same API?
136. also would have to use “/v1/” in their URLs
137. URI based versioning kills interoperability
138. YOU MIGHT BE WONDERING Why Exactly Is This Awesome?
139. THE MERITS OF REST • Easy to evolve: add new features or elements without breaking BC • Easy to learn: developers can "browse" service via link rels • Easy to scale up: grows well with number of features, users and servers • Easy to implement: build it on top of HTTP, and profit! • Authentication & TLS • Caching & Load Balancing • Conditional Requests • Content Negotiation
140. but...
141. hold on, you say
142. a plain HTTP-loving service does the job, you say
143. surely, there is a merit to REST beyond extensibility, you ask
144. nope
145. "REST is software design on the scale of decades: every detail is intended to promote software longevity and independent evolution. Many of the constraints are directly opposed to short-term efficiency. Unfortunately, people are fairly good at short-term design, and usually awful at long-term design." Roy Fielding
146. "Most of REST's constraints are focused on preserving independent evolvability over time, which is only measurable on the scale of years. Most developers simply don't care what happens to their product years after it is deployed, or at least they expect to be around to rewrite it when such change occurs." Roy Fielding
147. FURTHER READING • Leonard Richardson, Mike Amundsen, Sam Ruby
 RESTful Web APIs
 ISBN: 978-1449358068 • Jim Webber, Savas Parastatidis & Ian Robinson
 How to GET a Cup of Coffee
 http://www.infoq.com/articles/webber-rest-workflow • Roy Thomas Fielding
 Architectural Styles and the Design of Network-based Software Architectures
 http://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm
148. MORE BOOKS ON REST • Jim Webber, Savas Parastatidis, Ian Robinson
 REST in Practice
 ISBN: 978-0596805821 • Subbu Allamaraju
 RESTful Web Services Cookbook
 ISBN: 978-0596801687 • Leonard Richardson, Sam Ruby
 RESTful Web Services
 ISBN: 978-0596529260
149. The End
150. RESTFUL WEB SERVICES Thanks for listening! Contact: @dzuelke & dz@heroku.com. rate my talk on joind.in!