Mod 7

Question 1

When should we use an HTTP Get request?

Answer 1

When we type a URL in a browser, the browser sends an HTTP GET request to the server. GET requests should be used to read data from the server. The GET method is thus analogous to the Read/Retrieve operation among the CRUD operations. With a GET request, information is passed to the server via the URL path and the query string. While the HTTP specification does not prohibit sending a body with an HTTP GET request, sending a body with a GET request is not recommended at all.

Question 2

When should we use an HTTP Post request?

Answer 2

The POST method sends data to the server in the body of the request. Many times POST is used when submitting forms. A prescribed use of the POST method is for creating a new resource, e.g., a new document in a database. This means if an HTTP request being sent to the server to perform a create operation, then the POST method should be used. The POST method thus corresponds to the Create operation among the CRUD operations.

Question 3

When should an HTTP Put method be used?

Answer 3

While the POST method is used for create operations, the HTTP PUT method is used for update operations. A prescribed use of the PUT method is for HTTP requests in which a resource is completely replaced by the data in the HTTP request with the PUT method. For example, if we wanted to send an HTTP request to replace all the properties of a document to new values, then it would be an appropriate use case for the PUT method. The PUT method thus corresponds to the Update operation among the CRUD operations. Data is sent in the body of the request for HTTP requests that use the PUT method.

Question 4

When should an HTTP Patch method be used?

Answer 4

The prescribed use of the PATCH method is for partial updates of a resource, unlike PUT which is used for completely replacing the resource. For example, if we want to send an HTTP request to update some, but not all, properties of a document, then it would be an appropriate use case for the PATCH method. The PATCH method thus also corresponds to the Update operation among the CRUD operations. Note support for the PATCH method is not universal and many web server support partial updates using the PUT method.

Question 5

When should an HTTP Delete Method be used?

Answer 5

The prescribed use of the DELETE method is to delete a resource. For example, if we want to send an HTTP request to delete a document, then it would be an appropriate use case for the DELETE method. The DELETE method thus corresponds to the Delete operation among the CRUD operations.

Question 6

When should the HTTP Head method be used?

Answer 6

The HEAD method is similar to GET in that it requests a resource for retrieval. However, the response to a request using the HEAD method does not include the resource, but only includes the status line and the HTTP response headers. This is used by clients, such as browsers, to determine if the resource in their cache is still fresh, or should they now issue a GET request for the resource

Question 7

What is an endpoint?

Answer 7

The term endpoint is used for the combination of a URL and an HTTP method. Two requests that have the same URL, but different HTTP methods, are considered two different endpoints. In Express it is simple to define routes based on the combination of a URL and HTTP method

Question 8

How does a browser or a server know how to interpret bytes that it is sent?

Answer 8

This information is conveyed by using values from a standard called Multipurpose Internet Mail Extensions or MIME type. This is used in the Content-Type header.

• The typical structure of a MIME type is of the form type/subtype, i.e., two strings separated by a /.
• The type indicates a general category. Example types include text or application and image.
• The subtype indicates the exact type of data within that category.

Question 9

What is the accept header used for?

Answer 9

The Accept header is used in HTTP requests by a client to tell the server about the types of data the client can handle. In general, the value of the Accept header is one or more MIME types separated by commas.

Question 10

Are you likely to encounter 100-199 response codes?

Answer 10

Status codes in this category indicate that the request was received and the server is continuing to process it. They are very uncommon and you are unlikely to encounter them.

Question 11

What are the response codes in 200-299?

Answer 11

Status codes in this category indicate that the request was successfully processed by the server.

• 200: OK: The request succeeded and the response body has the needed information. The server will send this response code for successful requests in many cases, e.g., GET requests, DELETE and PUT requests if information about deleted/updated resources is being sent back in the body.
• 201: Created: The request succeeded and a new resource was created. Typically, a POST request will return 201 status code on success. Typically, the response with 201 status code includes the URL of the newly created resource in the response header Content-Location.
• 204: No content: The request succeeded. However, there is no content to return in the body. A typical use case is when the server has successfully processed a DELETE or PUT request, but there is no other information that the server is sending back beyond reporting the success of the request.

Question 12

What is the general use of response codes in 300-399?

Answer 12

• The server sends back status codes in this category when the client needs to take additional action to complete the request.
• These codes are mostly used for URL redirection. A common example is http to https redirection.

Question 13

What is the difference between a 301 and 302 response code?

Answer 13

• The 301 response code is sent when a resource has been permanently moved (like moving an http to https). The browser knows to always go to the new location, sent in the location header.
• The 302 response code is sent when a resource was found but a redirect was sent using the location header. This is common when you need a user to sign in at another page. The browser will not change the URI in future requests.

Question 14

What is a 303 status code?

Answer 14

303: See Other: Server is redirecting to another resource whose URI is in the location header. For example, a resource was created and its URI is in the location header.

Question 15

What is the 304 Status code?

Answer 15

304: Not Modified: The resource has not modified. Essentially the server is telling the client to use the cached copy of the resource.

Question 16

What are the status codes in 400-499?

Answer 16

The server program sends back a response in this category when the request was not valid and the server program could not fulfill it.

• 400: Bad Request: Client error preventing server from processing. Often missing parameter.
• 401: Unauthorized: The requested resource requires authentication, but the client is not authenticated, i.e., the server does not know who is making the request.
• 403: Forbidden: The client is authenticated but is not authorized to access the requested resource. In other words, the server knows who is making the request, but the requestor does not have privileges to carry out the requested operation on the resource.
• 404: Not Found: The requested resource is not found on the server.

Question 17

What are status codes in 500-599?

Answer 17

Status codes in this category are sent by a server when the request seemed valid, but the server fails to successfully process it.

We should typically log such error responses in our server programs so that we can investigate them and fix the issues that caused the error.

• 500: Internal Server Error: Our code throws an exception and we do not handle it. Often coding error.
• 502: Bad Gateway: Sent by the web server when it receives an invalid response from some other server, or a request to another server time out. Often misconfiguration.
• 503: Service Unavailable: This error code is sent by the server when it is not capable of handling a request. Overloaded or down for mainrenance.

Question 18

What is an HTTP cookie?

Answer 18

An HTTP cookie (also called browser cookie, web cookie, or simply cookie) is a small piece of data that is created by a web server and sent to the user’s web browser for storage. The browser can send this HTTP cookie in later requests to this web server thus identifying who this request is coming from. By linking together multiple requests from the same user, HTTP cookies allow web apps to overcome the stateless nature of the HTTP protocol.

Question 19

How are cookies communicated between the client and server?

Answer 19

• When the server wants the client to store a cookie, the server sends the cookie in the response header Set-Cookie containing the name-value pair for the cookie.
• When a client wants to send cookies to a server, it sends them in the request header Cookie as name-value pairs. A request can contain multiple Cookie headers, one for each cookie the client is sending to this server.

Question 20

What are signed cookies?

Answer 20

To prevent tampering of a cookie’s value by the user, we can use signed cookies. If the value of a signed cookie has been tempered with, the cookie-parser will recognize this and the server will reject the value of the cookie.

To use signed cookies, we need to provide a secret to the cookie parser middleware. The cookie parser middleware will then use this secret to sign the cookie.

Question 21

What is an HTTP session?

Answer 21

An HTTP session is a way to store cookies on the server (or in a database) so we do not slow down the interaction between the client and server and overburden the client with storage.

In an express app where we set up HTTP sessions, the request object will have a property “session” that we can use to set properties of the session object to store data.

import express from ‘express’;
import cookieParser from ‘cookie-parser’;
import expressSession from ‘express-session’;

…

const COOKIE_SECRET = ‘sOme4rAnDom$tringCangohere’;

// Sessions use cookie, so include the cookie parser middleware before the express session middleware
app.use(cookieParser(COOKIE_SECRET))

/*
* We are setting the age of the cookie to 60601000 milliseconds or 1 hour
*/
app.use(expressSession({
resave: false,
saveUninitialized: false,
secret: COOKIE_SECRET,
cookie: { maxAge: 3600000 }
}));

app.post(‘/’, (req, res) => {
// Set language preference on the session
req.session.language = req.body.language;
// Send link to greeting page
res.send(‘<a>Click</a> to get your greeting’);

Question 22

What is the problem with sessions stored on the server?

Answer 22

They are stored in memory so if the server shuts down or if requests go to different servers, they can’t be retrieved.

We should store sessions in a database, even though it is slower, to have scalability.

Question 23

What is a web service?

Answer 23

An API that can be accessed using the HTTP protocol.

Question 24

With REST APIs, how does a server manage and expose resources?

Answer 24

A server manages collections of resources. These resources are exposed to clients using unique urls following the pattern: collection/uniqueID/collection/uniqueID/……so on.

Question 25

With REST APIs, how should CRUD operations occur?

Answer 25

A server should support CRUD operations by providing a set of HTTP methods as follows:

• Create resources using the POST method.
• Read resources using the GET method.
• Update resources using the PUT method.
• Delete resources using the DELETE method.

Question 26

Is a RESTful server stateless?

Answer 26

Yes! A RESTful service should have a stateless server that does not use cookies or sessions to process requests with previous information. All needed information should be sent with an individual request.

Question 27

How do we access route parameters with Express?

Answer 27

• In the path argument of a route, we can specify which parts of the URL we want to be made available to the route handler.
• These parts of the URL are called route parameters.
• Express populates an object req.params in which
  The names of the properties are the names used in the path argument.
  1. The values of the properties are set to the 2. corresponding part of the URL.
• We define a route with the path argument /movies/:id.
• Express will add a property id to the object req.params
• If the request URL is http://localhost:3000/movies/xyz123.
• req.params object will be { “id” : “xyz123” }

Question 28

When data is sent by a form using a POST request, which MIME type is used in the Content-type header?

Answer 28

text/x-www-form-urlencoded

Question 29

What is the MIME Type for JSON?

Answer 29

application/json

Question 30

The HTTP protocol includes some methods that are not related to CRUD operations. (True/False)

Answer 30

False.

An example of a method that is not used for CRUD is the HEAD method.