There is a push in modern scripting frameworks to use RESTful request routing instead of a one-size-fits-all URL path routing.

respond('GET',    '/posts',       callback);
respond('POST',   '/post/create', callback);
respond('PUT',    '/post/[i:id]', callback);
respond('DELETE', '/post/[i:id]', callback);


respond('/posts',       callback);
respond('/post/create', callback);
respond('/post/[i:id]', callback);
respond('/post/[i:id]', callback);

I must confess that I am still using the old-and-busted method where the resource is accessible at the given URL regardless of the request type.

Is there anything I'm missing by using the old format?

  • Are people able to make GET requests against your URL that is responsible for deleting data? I believe that can leave you open to certain types of cross site forgery attacks. – Mike Aug 24 '11 at 20:52
  • "Nonces" or "Tokens" are always used to prevent that type of thing. Even though GET is easy to spoof, it's also posible to spoof a POST/DELETE. Use action tokens. – Xeoncross Aug 24 '11 at 21:01

In my view what you are missing on, is the inherent architecture of a RESTful API. From an implementation point of view, the separation of request, resource and callback function, that REST imposes, encourages you to use an architecture which, by design, is clear and understandable. Separation of concepts in distinct parts is very important, especially when dealing with security-sensitive applications like web APIs. It reduces the complexity of development, testing and maintentance, and thus makes them quite easier to handle.

  • How does it reduce the complexity of development, testing, and maintenance? From clarity? The slight increase in explicitness? – psr Aug 24 '11 at 23:19
  • Exactly. The explicitness makes things much easier to deal with, since there's such clear separation and isolation of the role of every callback. Of course the fact that REST imposes this inherent design princisples, doesn't stop anyone from having a terrible implementation. However I just think that it's a tad more difficult to mess up than other more fuzzy architectures :) – Charalambos Paschalides Aug 25 '11 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.