We want to figured out, whats are the pros and cons, when you use a REST api vs querying directly to a database, if you have different client platforms (Web-Application, Android, iOS).

Edit: I know that this question is very general and every developer has different opinions, but we only wan't to here some pros and cons to make our own. The answer from @Lewis helps.

  • 1
  • db con: doesn't work over the internet – Ewan Aug 13 '18 at 13:34
  • 1
    @Ewan. I disagree about approach not working over the internet. It can work quite easily (as long as you open the DB ports). I (sadly) worked on a project where this was done. It is a BAD idea for MANY reasons, but routing (and the internet) are not among them. – Lewis Pringle Aug 13 '18 at 14:26
  • @LewisPringle I am being a bit broad but I imagine 99% of mobiles wont have the required ports open on their network provider – Ewan Aug 13 '18 at 15:39
  • @Ewan. This I believe is a material misunderstanding. The ports would only be blocked on the firewall protecting the server (incoming) which the server would control. I've only very rarely seen (like inside dumb corporate nets) blocking of outgoing traffic by port. – Lewis Pringle Aug 13 '18 at 17:49

Pros of direct DB access (aka cons of REST)

  • It might be simpler to implement a first draft with direct DB access, because there's no need to design and develop a REST data model.

Cons of direct to DB (aka pros of REST)

  • The REST API is reused by all frontends: You only need to implement the DB layer once.
  • The REST API is an abstraction layer: You can change your DB representation freely and maintain a consistent API (so product evolution is easier).
  • The effort to think out a REST data model often pays dividends repaying its costs, because its then easier to build future apps on top of it, and will need to change less and the product evolves.
  • Security considerations are more cookbook with REST, and you can implement fine-grained access controls. Direct to DB security doesn't work well when clients are exposed (hard to make truly secure, maybe impossible for some client scenarios).
  • I'm sure many more, but this is a good enough start help you decide...
  • 2
    It doesn't even have to be REST. It just needs to be some abstraction layer that works over the Internet. – Robert Harvey Aug 13 '18 at 15:03
  • I edited the answer a bit to clarify how each item is a pro or con, please revert if you don't like it. I didn't quite understand what you mean by “clients are exposed”, could you perhaps edit to clarify? – amon Aug 13 '18 at 15:08
  • 1
    @amon I will explain why I meant here, rather than in the text, because its a small point. When the database access is in a server, you can use client side cert, long password/key etc to protect access to the database (and myriad other techniques). In many client access the DB scenarios, an attacker has direct access to the code accessing the database, and can easily simulate, track, and get access to the keys. HTTP is structured to avoid some of this problem, but database access protocols are not. OH - and thank you for your edits! – Lewis Pringle Aug 13 '18 at 15:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.