I have implemented a JSON-based REST API for a simple blog. The API allows for the creation, viewing, deletion and modification of user info, blogs, blog posts, comments, 'likes', etc. Some of these operations, such as deleting a blog post, require authentication. This is done using basic access authentication.
Now I need to implement a web front-end for the blog. The front end needs to be able to do all the same things as the JSON API, so it would make sense to use the API for the front end. The JSON API and the web front end are served by the same process on the same machine.
How should I use my JSON API for the front end? Should I use it at all? The options that I can think of are:
- The server recieves the request for e.g. a certain blog post. The server does a HTTP request to the JSON API, and passes the results straight to the template renderer, which returns the rendered page to the client. This would require storing the user's password in plain text for the duration of the session, so that the operations requiring authentication can be completed.
- An AJAX call is used to request the JSON, which is then rendered to the page. If the user has logged in successfully, the username is already associated with the session, so no password is required for calling the JSON API.
- Both the web front end and the JSON api use common code to manipulate the database, and each are responsible for using it correctly. This would require some refactoring.
- The JSON API and the web front end are totally separate, meaning that everything has to be implemented twice and maintained separately.