Like for example, /api_1/login and /api_2/login writing in the same table of the same database.

| improve this question | | | | |
  • What would be the alternative if they both require the information in that table? Keep separate identical copies of the table and try to keep them in sync? – Kayaman Aug 21 '19 at 9:21
  • According to me, well designed APIs should never have that situation. But again I'm a beginner seeking opinion from pros. – Bugs Buggy Aug 21 '19 at 9:22
  • If you're a beginner then you're not speaking from experience, therefore: why according to you a well designed API should never have that situation? – Kayaman Aug 21 '19 at 9:30
  • It's not really possible to give a good answer if all you tell about the APIs are meaningless abstract names. Fill in these placeholders with actual APIs and you might have a good question. – Hans-Martin Mosner Aug 21 '19 at 9:30
  • @Kayaman OP is probably not a native speaker and meant "in my opinion". – Hans-Martin Mosner Aug 21 '19 at 9:32

No. Apis are microservices, microservices are supposed to be contained. So they have their own database and don't call other peoples.

Of course this is an ideal and maybe you have very fine grained apis which are more like parts of a microservice. (or a massive fat API that does everything, but that's what people are trying to get away from)

The key thing you are trying to avoid is that changes to API X break random API Y. You want to be able to upgrade and change each API without affecting the others. If you know that the only way a DB is accessed is through its API then you have a controlled 'surface area'. As long as you keep that working you don't have to worry that some sneaky backdoor access will break.

Of course this has nothing to do with REST per-se. But I think I know what you mean.

So in your senario, instead of having two apis each with a login method, I would have three apis.

  1. auth api
  2. api 1
  3. api 2

Users login on the auth api and get the auth token which they pass to the other apis. The other apis check the token signature and claims to auth the user.

| improve this answer | | | | |
  • Are you really saying that REST API means "microservice architecture"? It's a popular combo, but I wouldn't say they're equivalent. – Kayaman Aug 21 '19 at 9:38
  • updated, no but yeah, its so popular I'm assuming thats what the OP means – Ewan Aug 21 '19 at 9:41
  • True, and since the updated question has /login endpoints, it doesn't make a lot of sense to have a single authentication table shared by 2 apis (not to mention that there are better ways for authentication in situations like this). – Kayaman Aug 21 '19 at 9:45
  • And what are such better ways? – Bugs Buggy Aug 21 '19 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.