0

I am currently sketching out a project I am doing at my job, where I will have a self hosted WebAPI, connected to a serial device, where the app I am creating will configure that device. No, it is not a Raspberry PI :)

So instead of having a database as a data source for the API, I would make calls to the serial device. I think that it is a pretty neat idea, and I can use the usual methodology for developing APIs.


So, I have one or two questions that I could use some help with.

Question 1: My company has a limited amount of these serial devices for testing purposes, so I can not rely on having a device every time I want to test my newly written code. So is it a good idea to have a flag in the http-request that specifies whether the api should get the data from the serial device or get testdata from say a document? I was thinking about a OWin middleware that can route the call to the correct service.

Question 2: Security. Since the selfhost API would be installed on the users local computer, and the webapp would only call localhost, is there any need to think about security and authentication and the like? The websuite that is present in my company has a authentication solution already, so is that enough? I always struggle when it comes to security concerns, so I have no confidence in my reasoning ability on that subject :)

1

So instead of having a database as a data source for the API, I would make calls to the serial device

I assume that you have already resolved the access to the device data. Probably, you have abstracted the access with a DAO-like component.

The first approach would be to mock up the DAO. While the main component does real access to the device, the mocked one is just going to provide data from a document (or any other support).

Would be interesting to know if the DAO can retrieve the state of the device (plugged / unplugged). While the real DAO could answer yes/no, the mock could answer allways yes (or make the answer parametrizable by configuration).

Finally make them work altogether implementing a Gateway.

So is it a good idea to have a flag in the http-request that specifies whether the api should get the data from the serial device or get testdata from say a document?

Following this approach, I suggest you to keep the API as agnostic to the environment as possible. Treat the device as if were a external service.

Adding flags to the request may fragment the code. What will lead you to non-functional if/else statements and polute the model with meaningless attributes.

Instead, use HTTP Headers. Implement your own headers (following some premises). Here a question related to the subject.

Example:

GET: /my/resource/id
Headers: [X-Serial-Device: xxxx, ...]

GET: /my/resource/id
Headers: [...] # No device

Due to the WebAPI is self hosted and mainly doing local requests, you have not to be worried about any proxy filtering the headers.

The header might also be the input you need to switch DAOs.

and the webapp would only call localhost, is there any need to think about security and authentication and the like?

Hard to say with so few details about what's your app for. Security is not related to where my app runs at is more related to Who is going to have access? And what are they going be allowed to do?.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.