REST and GraphQL Concepts Quiz

REST Introduction

• REST stands for REpresentational State Transfer
• Proposed by Roy Fielding in his PhD thesis in 2000
• Considered an Architectural Style, not a technology or framework
• Defined by principles and constraints; in contrast to SOAP, which is more constrained

REST Properties

• Implements client-server architecture
• Stateless system: each request treated independently, no session storage
• Supports caching mechanism
• Uniformly accessible: each resource has a unique address and access point

REST Architecture

• Web server acts as a REST system when a browser enters a URL
• Browser receives a representation of the resource's current state (can be static or dynamic -like news sites, blogs)
• Example: A webpage is a representation of its current state.

REST Abstractions

• Consists of three main abstractions: Resources, Representations, and Actions

REST Resources

• Anything accessible and transferable between client and server
• Includes states and functions
• Examples include reviews from Metacritic, images from Imgur, videos from YouTube, and order information from Amazon
• Each resource must have a unique Uniform Resource Identifier (URI) within HTTP.

URI

• URIs are not meant to change over time.
• They're the only way to locate a resource, and if the URI changes, links to the resource do as well.
• URIs are used to negotiate the specific data representation the client desires.
• Clients define what specific data they want in the URI using parameters.
• Servers respond with the requested resource representation containing the needed data.

URI Structure

• URI format: scheme[userinfo@]host[:port]path[?query][#fragment]
• Example: https://[email protected]:123/forum/questions/?tag=networking&order=newest#top
• The ?query portion allows the client to specify parameters for which data the client wants.

Representations

• Items transferred between client and server
• Resources are not sent, only their representations
• Format determined by content-type (e.g., HTML, XML, JSON)
• How a representation interacts depends on the action on the resource.

REST Representations (Details)

• REST uses HTTP for communication between clients and servers
• Browser understands data transfer due to the TCP/IP protocol and the HTTP response header's Content-Type
• A representation can be in text, image, video, or JSON format, consistently using the same URI.

REST Representations (Examples)

• Data transfer as JSON instead of plain text (readability isn't essential)
• Video resolution relevant to the platform (720p for a mobile device)

Actions

• Used to operate on resources
• Examples include reviews for films, posting images, watching videos, deleting files

HTTP Actions

• Standard HTTP actions: GET, POST, PUT, DELETE

Data Actions and HTTP Equivalents

• CREATE equivalent to POST
• RETRIEVE equivalent to GET
• UPDATE equivalent to PUT
• DELETE equivalent to DELETE

HTTP as Uniform Interface

• Resource names are important in RESTful systems
• Four specific actions available for interacting with resources: Create, Retrieve, Update, and Delete (CRUD)
• This contrasts with other web applications, which lack standardized naming and implementation standards

Example 1: Instagram API

• Service URL: https://api.instagram.com/
• Resources represented as JSON files
• User URI: https://api.instagram.com/v1/users/{user-id}
• Search URI: https://api.instagram.com/v1/users/search
• Location URI: https://api.instagram.com/v1/locations/{location-id}
• Example query: http://api.instagram.com/v1/locations/search?accesstoken=ACCESS_TOKEN&lat=40.7127&lng=74.0059

Example 2: GitHub API

• Service URL: https://api.github.com/
• Resources represented as JSON files
• User URI: https://api.github.com/users/{user-id}
• Organization URI: https://api.github.com/orgs/{organization-id}
• Repository URI: https://api.github.com/repos/{repository-id}
• Example query: https://api.github.com/users/octocat

GET Method

• Used for retrieving resources
• Should not modify the resource
• Can be used repeatedly without changing the resource's state
• Can return parts of a resource
• Altering the URI can act as a query operation

POST Method

• Used for creating resources
• Resource URI usually unknown at creation time
• Server usually automatically generates the new URI for the resource

PUT Method

• Updates resource using a representation as a payload
• A GET request first obtain the representation of the resource to be updated

DELETE Method

• Deletes resources
• Similar to PUT in operation
• Atomic operations. A single DELETE request determines the final state.
• Can be used to determine the URI of the resource to be deleted.

HTTP Status Codes

• REST services use HTTP status codes (e.g., 200 OK, 404 Not Found, 500 Internal Server Error) to communicate the result of requests.

Security

• RESTful services have three main security methods: custom token authentication, HTTP Basic Authentication, and OAuth.
• OAuth is preferred for accessing services on behalf of users, but other methods control access to resources directly.

Custom Token Authentication

• Server generates a unique token for registered API users
• Registered users send the token with every request
• Token can be part of the URI or added to the HTTP request header
• Can be used for additional functionality like billing based on GET requests

Advantages and Disadvantages of Custom Tokens

• Advantages: independent token generation, easy implementation, logging data exchange.
• Disadvantages: insecure token-copying reuse without authorization.

HTTP Basic Authentication

• Clients send username and password pair (encoded in Base64) in the HTTP Authorization header.
• Client may receive 401 error if no username/password is provided
• Needs to be sent with every HTTP request for validation.

HTTP Basic Advantages and Disadvantages

• Advantages: manageable server authorization requests, reasonably secure with HTTPS (SSL).
• Disadvantages: not secure without HTTPS, Base64 encoding can be deciphered.

OAuth 2.0

• Preferred authorization scheme for RESTful services
• Easy integration, open-source protocol
• Allows third-party access to user data in a web service, with user consent, without exchanging username/password.

OAuth 2.0 Example

• User logs into game via Facebook
• Game accesses user data from Facebook
• Authorization granted by Facebook for the game application.

OAuth 2.0 Process

• User initiates Authorization Request
• Authorization Grant
• Access Token
• Protected Resource Access

Java REST Example

• Demonstrates a simple example (or examples) of a Java program or code related to RESTful Web Services.

GraphQL (Successor to REST)

• Open-source data query and manipulation language and runtime
• Developed internally at Facebook, publicly released in 2015
• Clients define the data structure required
• Returns exactly the structure requested from the server
• Potentially reduces data transferred compared to REST

GraphQL Design

• Models data as types and fields
• Functions for accessing data based on types and fields
• Queries validate against the defined fields and types
• Results returned in formats like JSON, XML, etc.
• Supports mutations for updating or creating data

GraphQL Examples

• Query example: retrieving hero's name
• Mutation example: creating a review

GraphQL Example Mutation Variables

• Example demonstrating how variables are passed to a mutation

GraphQL Example Mutation Result

• Demonstrates the format of the returned data from running a GraphQL mutation

GraphQL vs. REST

• GraphQL provides reflective discoverability (inspecting schema). REST uses hypermedia.
• GraphQL simplifies client-side work by reducing data fetching. REST uses caching.

GraphQL Conclusions

• GraphQL shifts server responsibilities to the client
• Aims for returning minimal data upon request
• Can be implemented along with REST(currently by GitHub)
• The suitability of GraphQL depends on the implementation quality of the REST system.