152 votes
Accepted

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

Alice wants to pay Bob for a service. Bob has quoted her $10. Give this quote a unique token. Alice clicks pay. When this response is send to the server, it must go with the token of ...
  • 8,721
60 votes
Accepted

Should I use HTTP status codes to describe application level events

Interesting question. Basically, we can reduce this down to the right way to classify things in terms analogous to OSI layers. HTTP is commonly defined as an Application Level protocol, and HTTP is ...
  • 9,130
58 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

A quote should be a write-once record. Bob isn't allowed to edit it once it has been created and passed to Alice. You can ensure this at different levels, from simply not offering an edit dialog to ...
30 votes

Should I use HTTP status codes to describe application level events

This question is a bit opinion based, but either way. The way i see it, 200 can serve "soft errors". When it comes to building API's i try to distinguish between these and "hard errors". "Soft ...
  • 768
28 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

This must be an extremely common problem to deal with, no? No, it isn't. I doubt you'll be able to find a payment processor that lets you change the amount after the customer has authorised a ...
  • 10k
25 votes

What's the point with HATEOAS on the client-side?

the app we are building won't simply look at the links and then by itself render the correct UI and make the right ajax calls In fact, this is exactly what HATEOAS will give the UI. Not what is ...
  • 1,195
24 votes
Accepted

How do desktop applications get notified of events over the internet?

Be aware that to be able to send an information, the sender needs to know the target. Normally the client knows the server. But the server has no clue about the clients until they try to connect. ...
  • 1,493
20 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

Just send the amount Alice agreed to pay along with the request. If the price has increased since Alice sent the request, you send a response indicating that the item could not be purchased at or ...
  • 739
19 votes

Should I use HTTP status codes to describe application level events

There are two aspects of an API: The effort to implement the API, and the effort of all the clients to use the API correctly. As the author of the client, I know that when I send a request to a web ...
  • 38.5k
18 votes

Why can't we use IP address instead of cookies in identifying the client in servlets?

Sometimes you can use IP address. If you're on a LAN or are otherwise dealing exclusively with users that have IP's statically distributed to single clients, using that address is perfectly fine -- ...
  • 13.2k
14 votes

.NET: Are web-based applications inherently harder to build than client-server?

Building a web application is absolutely more complicated and harder to build than client-server, for a given set of features. There are a variety of reasons and ideas I'll describe in no particular ...
  • 27.3k
13 votes
Accepted

What makes (or why is) a language Server-Side?

the solid, defining line on can/can't be server-side by taking requests and returning a database call, that is puzzling. Quite puzzling, I'd imagine, given that such a line does not exist for ...
  • 5,630
11 votes
Accepted

Multi-tenancy...as opposed to what?

I think your confusion is between the technical term "client" (as in client-server) and the business term "client" (as in, a paying customer). Multi-tenancy usually implies a server serving multiple ...
10 votes

Why can't we use IP address instead of cookies in identifying the client in servlets?

Three more reasons to add: Multiuser workstations and terminal servers exist. Many users could be running completely independent browser processes in separate sessions. IP addresses aren't ...
  • 1,558
10 votes

Architecture for OAuth2 - BackendServer - FrontendServer

First, you will need **HTTPS**. HTTPS = HTTP + SSL/TLS. It creates a security layer on top of your HTTP and prevent a lot of attacks. For that layer to work you will need to trasmit and receive ...
  • 1,411
8 votes

.NET: Are web-based applications inherently harder to build than client-server?

No, not necessarily. What you need to understand is that the Web architecture is a Client-Server architecture, it's just that the Client here is provided for you (the browser). The real question is, ...
  • 36.7k
8 votes
Accepted

How to deal with faster computers in a client/server real-time videogame

Your third idea seems to be the closest to what I think of as the industry solution to this sort of problem. What you're describing is commonly referred to as Ticks. In each tick, a fixed number of ...
8 votes

How do large engineering teams describe the interface/contract between a web service and client JavaScript code?

I'm looking for a formal way for a front-end and a back-end team to communicate on the shape of a JSON web API @RobertHarvey hit the nail on the head. Unless this is a public API, the usual way ...
  • 11.9k
8 votes

How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?

Yes this is a common issue, and it is about transactional consistency. To summarize your issues: the quote is binding for the seller. In general it has a reference and an expiration date/time. the ...
  • 69.7k
7 votes
Accepted

Should a client ever test server response at runtime?

Yes, you should validate what you get, but you also need to be a Tolerant Reader: http://martinfowler.com/bliki/TolerantReader.html Martin Fowler states that: My recommendation is to be as ...
7 votes
Accepted

RESTful API, what's the best way to implement status changes and events?

If you google "REST partial update" you will get a lot of opinions. Having said that I'll give you my thoughts. A PUT should be used for a full update of a resource so only changing one parameter ...
  • 2,983
7 votes

MVC as a subset of client-server architecture?

No. MVC relates to the design and structure of an application as it pertains to the internal flow of data, and the eventual presentation of that data. It is entirely orthogonal to whether that ...
7 votes
Accepted

How do multi packet transmissions work with UDP?

I have been reading up on UDP connections There is no such thing as a "UDP connection". UDP is a connectionless protocol, that is pretty much its reason for existing in the first place. So if ...
6 votes
Accepted

Generation of ids in offline/online application

There is no way you can get around having more than one way of uniquely identifying your entities. The best you can do is grit your teeth and confine the problem to the smallest possible scope. For ...
6 votes
Accepted

How should I pass login data from client to server using REST API

I recommend keeping your RESTful interface stateless. This means for every request, you must pass in all authentication information. I have used Basic Authentication (credential in HTTP headers) ...
  • 1,956
6 votes

Web Applications REST API: Should the data be structured to meet the UI's requirements on the client or on the server?

It really depends on your target audience for the API. If you intend on publishing a public API, then you really need to design toward that. If the API is strictly to support the UI, then let it be ...
5 votes

How to detect client character encoding?

Guessing the encoding of a message based on its byte values is always imperfect, although it can be made to give relatively accurate results. There are libraries available to do this, e.g. IBM's ICU. ...
5 votes
Accepted

Pattern for checking online service availability

I would Check Availability on Failed Action. Just issue your calls normally and if you get a failure, then call the Service Availability function to verify. Assume service is up, if one gets and ...
  • 10.8k
5 votes
Accepted

get All data vs get partial data Optimization

It depends. Basically, you have to look at what the expected latency of the connection is, what the bandwidth is, and what responsiveness you want. As an example: Suppose the round trip latency from ...

Only top scored, non community-wiki answers of a minimum length are eligible