REST API Flashcards
What is REST?
REpresentational State Transfer. Is an architectural style for providing standards between computer systems on the web, making it easier for systems to communicate with each other
What is API?
Application programming interface. Is a computing interface that defines interactions between multiple software intermediaries. It defines the kinds of calls or requests that can be made, how to make them, the data formats that should be used, the conventions to follow, etc.
What is HEAD request?
- The HTTP HEAD method is used to request HTTP headers from the server.
- The HTTP HEAD request is identical to the GET request except that the server must not return the message body in the response.
- The HTTP HEAD request may be executed before loading a large resource, to check resource size, validity, accessibility, and recent modification.
What is http header?
HTTP headers let the client and the server pass additional information with an HTTP request or response
( Content-Type for example )
What is the difference between POST and PUT?
Practically speaking, POST is used to append a resource to an existing collection, while PUT is used to update an existing resource.
PUT puts a file or resource at a specific URI, and exactly at that URI.
POST sends data to a specific URI and expects the resource at that URI to handle the request
What are the most important points when you develop API?
- security
- accessibility
- usability
- reliability
- versioning
What authentication API methods do you know?
- Username and password as parameters
- HTTP basic authentication
- HTTP cookies
- SAML
- JWT
What is HTTP basic authentication?
When we use:
• HTTP methods: GET, POST, PUT, DELETE, PATCH, and
more
• HTTP header: Authorization: Basic bXk6Ym9vaw==
• Content-Type: Any
What is ‘Username, password as parameters’ authentication methods?
When payload (message body) includes username and password.
HTTP methods: POST, PUT, PATCH, and more.
Methods like GET or DELETE may include username
and password as URL query parameters (i.e. GET /authenticate?
username=bob&password=secret)
What 2 authorization approaches do you know?
- Preemptive Authorizations
- Just-in-Time Authorizations
What are the difference between Preemptive Authorizations and Just-in-Time Authorizations?
Preemptive Authorizations:
- User instructs client to make a request to http://user:pass@example.com
- Client makes a request with a header like: Authorization: Basic dXNlcjpwYXNz
- Server authenticates the user and response with 200
Just-in-Time Authorizations:
- User instructs client to make a request to http://user:pass@example.com
- Client makes a request without authentication
- Server responds with 401 and a header like: WWW-Authenticate: Basic realm=”Default Realm”
- Client makes a second request with a header like: Authorization: Basic dXNlcjpwYXNz
- Server authenticates the user and response with 200
What OAuth flows ( grand types ) do you know?
- Implicit grand ( one request and you get access token )
- Authorization code grand ( first request gets authorization code the second gets access token)
- Resource Owner Password Credentials (ROPC) Grant ( One request and you send password in this request)
- Refresh Token Grant ( one request to get a new access_token using refresh token)
- Client Credentials Grant ( the same as password but with credentials)
What part we need to consider during API implementation?
- Security
- API restriction
- Rate limit
- Request size/type validation
- Response handling
- Errors handling
- Caching
- Documentation
What is API gateway?
It’s like api proxy. It’s like additional layer to handle common things for API. API gateway doesn’t keep business logic.
What Are API Gateways Used For?
- Access control (i.e. who can access)
- Network-level security (i.e. use of TLS)
- Message security (i.e. message encryption)
- Message validation and transformation (i.e. from JSON to
XML) - Message routing (i.e. forwarding messages via HTTP)
- API availability (i.e. accessible during certain hours)
- Logging
- Threat protection (i.e. protecting against SQL injection)
- Support for messaging (i.e. HTTP to MQTT)
- Support for accessing data sources (i.e. accessing
databases)
