Is it a Good Idea to use REST API from Javascript Code

Question

I am Developing a E-Commerce Web Application as a part of my learning using Spring Hibernate and AngularJs.

I have written some Rest API's Controllers in Spring and then from the Web Component i am invoking the same using Angular Js like the below :-

 storezillaadminapp.service('CategoryService',function($http){

    var listCategories = [];

     this.getAllCategories = function() { 
         return $http.get(_contextPath+'/categories');
     };

     this.addCategory = function(category) {
       return $http.post(_contextPath+'/categories/add',category);  
     };

     this.updateCategory = function(category) {
       return $http.put(_contextPath+'/categories/edit',category);  
     };

     this.removeCategory = function(id) {
         return $http.delete(_contextPath+'/categories/remove/'+id);
     };
 });

1. The concern here is, It is a Good idea to expose the rest api's from javascript code like the above ? The reason for asking this is that, at the end of the day, all the js files get downloaded onto the clients machines making your API more vulnerable. What would be the ways to hide this even if the approach is used.

2. I have seen lots of applications which write some Server side Ajax Code to handle Ajax Requests.

Thanks !

Answer 1

If we're talking about JavaScript then yes, it is a good idea, because it's, sadly, the only tool at your disposal.

Think of your REST API as a public website. When you are creating a website and you do not want users to do something, you do not implement that functionality or forbid certain users from using it. With a REST API which should have public endpoints it is pretty much the same, you need to treat it like a public website.

Your REST API should be robust enough not to allow invalid operations, such as access to data from a different user.

If you are worried that some people could (D)DoS the server on which the REST web service runs, you are worrying too much. The same may happen even when you do not have a (REST) web service at all and everything is processed through standard requests.

If the REST API provides back-end logic for a public application you should treat the REST API the same, with the same accessibility. If you have a REST API which should be private then it obviously should not be a part of a public website and should be shared through private channels, and if deemed necessary be restricted only to specific users/IPs.