9
Yes, anyone can easily find the key.
The simplest method would be to use the .net development tools (available for free download from Microsoft) which contains a decompiler. Aim the decompiler at the program and look for any strings, not to many will look like keys...
If that fails because you were a smart cookie and encrypted the key. They could still ...
3
The format of the response body for an error like 404 can be defined in the Content-Type in the header of the response (Content-Types can be more than just "json", you can define and document your own Content-Types that explain the actual format of the error. See here. Clients can then know what data they are getting back when something happens)
This doesn'...
3
Vaughn Vernon in "Implementing Domain-Driven Design" advises the following:
Depending on the purpose of a Domain Service, it can be quite simple
to model. You’ll have to decide whether or not your Service should
have a Separated Interface [Fowler, P of EAA].
Then also gives the following choices:
Interface can be declared in the same package/module ...
2
You are probably having trouble deciding where to put things, because there is no meaningful (i.e. business-related) packages or projects.
Let's look at this pragmatically. I see your design 3 levels deep, yet I have no idea what your project is about.
Also, let's say you make a change. The client tells you to add a new type of product (or whatever your ...
1
REST doesn't constrain your resource identifiers, beyond the expectation that they will satisfy the production rules described in RFC 3986. The machines just don't care. So any spelling that will satisfy your local code review is fine.
Some spellings are more convenient than others, because they encode information that can easily be described by a URI ...
1
Same for any language... Catch the exceptions at the boundary. Handle those errors immediately, or translate them to something your application understands and rethrow them.
Third Party Software
To get anything useful done you need to interact with other software. Unfortunately this means interacting with a foreign understanding of the world.
As you've ...
1
Can both programs run from the same node?
Are the programs happy with sharing their node?
What level of service are you trying to establish?
Is there enough compute resources on that single droplet to maintain both programs, especially during peak load?
Is there an overriding concern such as security, reliability, or a business/country policy/regulation ...
1
This may be a feasible approach if the client can't directly get a JWT from the 3rd party API which it later will make direct requests to. If I understand you correctly, the website backend must request to JWT from the 3rd party API for the client which is not able to do this alone.
There is no correct way of making a valid JWT available to the client. If ...
1
I had different responses for the exceptions but then an Android dev
complained that he needed to do some manual checks because of that.
This is more important than any of the answer here.
If you know the audience to whom the API is addressed you should hear them first. If they have different opinions, sit with them and allow them to expose their ...
1
I am a regular user of the Stack Exchange API. It uses the same schema for errors and for successful responses, the wrapper. Of course, different fields will be filled; just compare the responses to the Site Information call for an existing site: https://api.stackexchange.com/2.2/info?site=softwareengineering and a non-existing one: https://api.stackexchange....
Only top voted, non community-wiki answers of a minimum length are eligible
