rest - Had to use POST for GET job for security reasons, Is there any alternate approach to without compromising api naming conventions? -


we using post /xxx/usage/get instead of using get /xxx/usage security reasons, per api naming conventions verbs not allowed used in resource path. using post instead of avoid sending sensitive information on query param, best way identify uri has job??

option 1: use method, since security primary concern. avoided. option 2: while using post, use naming convention tell job without compromising naming convention. thinking of using post /xxx/usage/queries.

we using post instead of avoid sending sensitive information on query param, best way identify uri has job??

you don't.

in rest, uri opaque -- clients not supposed make assumptions based on spelling of identifiers. information encoded identifier done @ server's discretion , own exclusive use.

when communicate resource responds post messages (whether documentation, hypermedia, or options), communicating specific messaging semantic cannot overridden changing spelling of identifier.

as far rest concerned

post /7fa070bc-4e98-4bd1-b525-d5564b918e4c

is fine. not human readable might like, human readability optional.

you'll want stick recommendations in rfc 3986; here, means path segments should align link hierarchy.

most spelling conventions uri focus on identifying noun -- integration resource handles particular request. note identifier resource, not method -- if suitable get, fine post well, generally.

so can replace

get /xxx/usage?sensitive-information-here

with

post /xxx/usage  sensitive-information-here

but

post /xxx/usage/queries

is fine; can go that, long doesn't violate local spelling conventions.


Comments

Post a Comment

Popular posts from this blog

android - InAppBilling registering BroadcastReceiver in AndroidManifest -

i'm implementing inapp billing in android app. works well, however, i'm trying decouple broadcast receiver activity manifest. suggestion in android's trivialdrive sample: // important: dynamically register broadcast messages updated purchases. // register receiver here instead of <receiver> in manifest // because call getpurchases() @ startup, therefore can ignore // broadcasts sent while app isn't running. // note: registering listener in activity bad idea, done here // because sample. regardless, receiver must registered after // iabhelper setup, before first call getpurchases(). currently there's class extends broadcastreceiver : public class iabbroadcastreceiver extends broadcastreceiver { /** * intent action receiver should filter for. */ public static final string action = "com.android.vending.billing.purchases_updated"; private final iabbroadcastlistener mlistener; public iabbroadcastreceiver(iabbroadcastlistener listener) { m...
Read more

python Tkinter Capturing keyboard events save as one single string -

is possible store keyboard events 1 string? code below stores 1 char , prints it. card reader or bar code reader, contains collection of character/ string not 1 character @ time. goal save char pressed text variable. from tkinter import * root = tk() def key(event): text= event.char text+= event.char print ("pressed", text) def callback(event): frame.focus_set() print ("clicked at", event.x, event.y) frame = frame(root, width=100, height=100) frame.bind("<key>", key) frame.bind("<button-1>", callback) frame.pack() root.mainloop() currently, creating text variable , everytime key() function gets called, , text stores last character typed. you can define text module level variable , , use module level text inside key function - text = '' def key(event): global text text+= event.char print("pressed", text)
Read more

sql server - Why does Linq-to-SQL add unnecessary COUNT()? -

here tables: create table customer ( cid int primary key, name varchar(32) ) create table ord ( oid int primary key, cid int foreign key references customer, address varchar(20) ) here's linq-to-sql statement: var aaa = c in db.customer select new { c, o = c.ord.tolist() }; and here's inexplicable query generated linq-to-sql: select [t0].[cid] [cid], [t0].[name] [name], [t1].[oid] [oid], [t1].[cid] [cid2], [t1].[address] [address], (select count(*) [dbo].[ord] [t2] [t2].[cid] = [t0].[cid]) [value] [dbo].[customer] [t0] left outer join [dbo].[ord] [t1] on [t1].[cid] = [t0].[cid] order [t0].[cid], [t1].[oid] i want understand how rid of count(*) part. it's entirely uncalled for! linq needs count(*) in order determine number of entries returned o = c.ord.tolist() .
Read more