REST API Response Codes & Error Reporting

• REST stands for "representational state transfer."
• "RESTful" describes a web service adhering to REST principles.
• REST's formal definition specifies that the service should be cacheable and layered.
• HTTP constraints make it hard to create a non-RESTful API.
• APIs enable creating apps for self-guided tours using phones/tablets.
• Location-aware apps can notify users about nearby points of interest.

API Error Reporting

• HTTP APIs use HTTP status codes for error reporting.
• A 200 (OK) indicates a successful HTTP request.
• A 500 (Internal Server Error) means request failure.
• Errors get grouped into catastrophic errors, recoverable server errors, and client errors.

API Response codes

• 1xx response codes mean Informational
• The server acknowledges the request in 1xx
• 2xx response codes mean Success
• The server completed the request as expected in 2xx
• 3xx response codes mean Redirection
• The client must performs further actions to complete the request successfully in 3xx
• 4xx response codes mean Client Error
• The API request failed with the information provided
• Examples of 4xx reasons include missing parameter, no API key
• These errors can be handled programmatically
• 5xx response codes mean Server Error
• The server failed to fulfill a valid request due to an error with the server.
• If you experience an error in this range you should contact Customer Support.

Cross-Origin Resource Sharing (CORS)

• CORS safely bypasses the same-origin policy.
• It allows web pages to access restricted resources from servers on different domains.
• Web pages can embed cross-origin images, stylesheets, scripts, iframes, and videos freely.
• Ajax requests are forbidden by default in cross-domain situations due to the same origin security policy.
• CORS defines how browsers/servers determine if cross-origin requests are permissible.
• It allows more freedom than same-origin requests but remains more secure than completely open access.
• CORS can be enabled app.use(require('cors')()).
• Applying CORS only where needed is recommended to prevent attacks
• To expose an entire API but only on /api, restrict CORS to paths starting with /api via app.use('/api', require('cors')());

Express API

• Express can provide an API.
• Express implementation: use require(./models/attraction.js).

Security

• Most websites/applications have some security requirements.
• Topics include HTTPS, building secure websites, authentication, and third-party authentication.

HTTPS

• HTTPS is the first step in providing secure services.
• HTTPS encrypts packets, hindering attackers from accessing transmitted info.
• HTTPS is a foundation for securing a website.
• HTTPS does not provide authentication, but it lays the groundwork.
• Unencrypted passwords negate authentication sophistication.
• Security depends on the weakest link.

SSL Certificates

• The HTTPS protocol needs the server to have a public key certificate, sometimes called an SSL certificate.
• X.509 is the current standard format for SSL certificates.

Types of SSL certificates

• Domain Validated SSL Certificate
• Organization Validated SSL Certificate
• Extended Validation SSL Certificate
• Wildcard SSL Certificate
• Multi-Domain SSL Certificate

Benefits of SSL Certificates

• Boosted Google Ranking with HTTPS
• Protected internal and client data
• Enhanced conversions & client trust
• Safer environments for customers
• Boosted Security for Sites & Apps
• Encrypted server-browser communication

Certificate Generation

• Generating your own certificate is suitable for development/testing.
• Due to hierarchical nature, browsers trust certificates generated by known Certificate Authorities (CAs).
• Websites using certificates from unknown CAs will trigger browser warnings.
• HTTPS relies on trust
• Obtaining certification is not only legitimate option for production-ready certificates
• CACert employs a point-based "web of trust."
• 90% of root certificates distributed with browsers are owned by Symantec, Comodo Group, Go Daddy, and GlobalSign.

Enabling HTTPS for Express App

• Private keys and certificates needs to be added to the app
• Switching over to HTTPS requires private key and SSL cert storage in ssl subdirectory.
• To enable Https, use var https = require('https');
• To assume the server is running on port 3000 from http://localhost:3000 connect to https://localhost:3000, instead of http://localhost:3000

Ports

• All web traffic is handled via Port.
• Port 80 is for HTTP and 443 is for HTTPS.

HTTPS Port 443 importance

• Keeps payments secure with SSL certificates and encrypted connections.
• Reassures customers that their data is protected.
• Secure data in transit and prevent man-in-the-middle attacks.
• Improves visibility on Google for higher search engine ranking.
• Boosts conversion rate via increased trust.
• Removes "not secure" warnings from browsers.

Authentication vs. Authorization

• Authentication, verifying users’ identities.
• Authorization, determining what a user can access, modify, or view.

Authentication

• This process conforms the user's identity
• Authentication methods include passwords, two-factor authentication, Captcha tests, and biometric authentication.
• Authentication is controlled by a server to know who is accessing the data or site.

Authorization

• This process verifies user's permissions to access resources.
• Authorization techniques include OAuth and file permissions (read-write access), data access, and user roles.
• The server decides if the client has authority to access a resource.

Third-Party Authentication

• Third-party authentication services are platforms for web applications offering authentication and authorization features.
• Third party authentication examples include user registration, login, password reset, social login, email verification, and role-based access control.
• Three advantages include lowered authentication burden, reduced "password fatigue", and "frictionless" logins.

Entities in 3rd Party Authentication

• HTTPS is used for all interactions.
• Third party authentication includes an application server, callstats.io, clients (trusted and untrusted).

Passport

• Passport is a Node/Express authentication module.

Third-Party Authentication Flow

• Authentication occurs on the third-party website.
• The login page lets users choose their login method.
• An authentication request is created to be sent to a third-party via a redirect.
• Verifying both authentication and authorization

Benefits of Using Third-Party API.

• Enhanced Functionality
• Time and Cost Savings

API Authentication

• API keys identify the application and grant access.
• While they are simple to use, API keys can be less secure if not handled properly.
• OAuth (Open Authorization) is a secure method used by social media platforms, involves obtaining access tokens.
• REST can work with XML, JSON, HTTP, and plain text
• SOAP works with XML
• REST is highly scalable with medium security
• SOAP has limited scalability with high security

Integrating Third-Party APIs Effectively

• APIs require thorough research of the documentation.
• APIs require well-tested systems with robust security.
• Scalable integration designs are important.
• API needs error-handling mechanisms and simplifies technologies
• Google and Bing both provide RESTful services for Geocoding.
• Interactive Google Maps require an API key.

Debugging

• Debugging finds and fixes errors/bugs in source code.
• The first debugging principle is elimination.
• Types of debugging tools include: Integrated Development Environments (IDEs), Standalone Debuggers logging Utilities, Static & Dynamic Code Analyzers, Performance Profilers

Difference between Debugging and Testing

• Testing finds bugs and errors.
• Debugging corrects the bugs found during testing.
• Testing identifies defects.
• Debugging fixes defects.
• Testing identifies code failure.
• Debugging gives absolution to code failure.
• Testing is done before debugging.
• Debugging happens differs between Testing and right after
• Testing executes software with test cases.
• Debugging analyzes symptoms to identify root causes.
• Testing can involve using automated or manual testing tools.
• Debugging uses tools and techniques like logging, tracing, and code inspection.

REPL & console

• REPLs allow to write JavaScript interactively.
• Console logging in Node displays object contents in an easy-to-read format.

Node debugger

• Breakpoints needed on critical parts of code
• Inspect mode helps in debugging
• Print statements are useful for debugging

Async Debugging

• Asynchronous functions can produce unexpected output orders.

Disadvantages of 3rd Party Authentication

• Loss of control over the user experience.
• Security and privacy concerns with user data sharing.
• Compliance with third-party terms of service limitations.

Authentication services

• Authentication services are identity verification mechanisms (similar to passwords) for apps, websites, or software systems.
• Authentication services authenticate clients (or users) by servers and vice versa.

Third-party sign-ins

• Third-party sign-in is a type of federated sign-in that logs you in with an identity service instead of website-specific credentials. "Third-party source" means a supplier/service provider not controlled by the seller or customer in a business transaction. Single-factor authentication using basic static passwords is the weakest due to vulnerability to attacks. The most common type of authentication used is password-based login which uses username/mobile number with a password.