152
votes
Accepted
How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?
Alice wants to pay Bob for a service. Bob has quoted her $10.
Give this quote a unique token.
Alice clicks pay.
When this response is send to the server, it must go with the token of ...
- 9,201
58
votes
How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?
A quote should be a write-once record.
Bob isn't allowed to edit it once it has been created and passed to Alice.
You can ensure this at different levels, from simply not offering an edit dialog to ...
44
votes
What belongs in an HTTP request header vs the request body?
While the line is somewhat blurry, for me a rule of thumb is: data that your business logic works on should be in the body, metadata can/should be put in headers.
Another way of looking at it is: ...
- 3,554
38
votes
Should we create a new single instance of HttpClient for all requests?
I'm late to the party, but here is my learning journey on this tricky topic.
1. Where can we find the official advocate on reusing HttpClient?
I mean, if reusing HttpClient is intended
and doing so ...
- 721
29
votes
How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?
This must be an extremely common problem to deal with, no?
No, it isn't. I doubt you'll be able to find a payment processor that lets you change the amount after the customer has authorised a ...
- 11.6k
27
votes
Pattern Matching on Request Body for Routing an HTTP Request
What you're asking is essentially having the mailman deliver the packages differently based on what's inside the package. The mailman should not be looking in there.
Other information, such as the URL,...
- 56.3k
20
votes
How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?
Just send the amount Alice agreed to pay along with the request. If the price has increased since Alice sent the request, you send a response indicating that the item could not be purchased at or ...
- 783
16
votes
Accepted
What is a proper response status code to POST when parent resource is not found?
404 NOT FOUND seems to be an appropriate response, because the resource with this ID does not exist. It's very clear to understand and you are expecting the same response if a/{id} is called.
409 ...
- 2,476
16
votes
Use Case of HTTP GET Request with a Body
GET requests with a body are supported in the HTML specs.
See the Stack Overflow question Is this statement correct? HTTP GET method always has no message body for a discussion.
However, it's unusual. ...
- 79.9k
14
votes
Accepted
What reasons are there AGAINST using only POST HTTP verb in an API?
"What reasons are there AGAINST using only POST HTTP verb in an API?"
You have answered your own question:
The goal is to be very quick and easy to adapt and use for other developers...
If your ...
- 3,123
13
votes
Accepted
What makes (or why is) a language Server-Side?
the solid, defining line on can/can't be server-side by taking requests and returning a database call, that is puzzling.
Quite puzzling, I'd imagine, given that such a line does not exist for ...
- 5,666
13
votes
How to map "mv" operation to HTTP verbs?
Is there a RESTful way to implement this whilst maintaining atomicity of the operation?
Short Answer
Just use POST
Medium Answer
Seriously; it is okay to use POST.
POST serves many useful purposes ...
- 33.7k
8
votes
Accepted
What is the right way to make HTTP requests when a slider's value changes?
It really depends on how you intend to provide feedback and how quickly your hardware controller can respond. There is more than one way to handle this, and the correctness of the solution really ...
- 46.3k
8
votes
How do searches fit into a RESTful interface?
This is an old answer but I still can contribute a bit to the discussion. I've observed very often a misunderstanding of REST, RESTful and Architecture. RESTful doesn't ever mention anything about NOT ...
- 181
8
votes
What reasons are there AGAINST using only POST HTTP verb in an API?
If you want to make things easy for developers using your api, don't worry about the RESTfulness of various verbs.
Publish A Client
If you publish a client then GET or POST is an implementation ...
- 79.9k
8
votes
How do I mitigate a scenario where a user goes to pay, but the price is changed mid-request?
Yes this is a common issue, and it is about transactional consistency.
To summarize your issues:
the quote is binding for the seller. In general it has a reference and an expiration date/time.
the ...
- 80.6k
8
votes
Email Confirmation links must be GET, but not safe
Let's have a look into the RFC-7231: 4.2.1. Safe Methods. Safe methods are allowed to do state changes, althoug it is highly not recommended. So this is not a violation of the Standard. It's more a ...
- 204
8
votes
Accepted
Email Confirmation links must be GET, but not safe
Rather than being language lawyers and analysing the spec, let's look at the possible downside of a GET request changing the state in this case:
The action might be triggered without user interaction,...
- 5,887
8
votes
HTTP REST API: Is it wrong to put search parameters in a custom header?
One of the main ideas behind REST is that each resource should be identifiable by a unique URL, and requesting a resource should be as simple as requesting this URL.
When you transfer search ...
- 864
7
votes
REST Webservices (post / put) : which type of parameter should I choose, and when?
REST API over HTTP 1.1
These are the "principles" we consider when parenting to be make a Web API. But not the only! See also CoRE RFC6690)
Path variables
Used to
identify resources within a ...
- 14.8k
7
votes
Accepted
Is get and post interchangeable?
Yes given you have control over the server's handling of this. I worked with some java server code that treated both methods as equivalent. In fact, the operation is really just a string that is ...
- 28.9k
7
votes
What is a proper response status code to POST when parent resource is not found?
In addition to @Dherik's answer.
URIs are identifiers, so we have to keep in mind that (/a/{id}/b is an identifier). The URI is meaningless for the WWW, and so is for the HTTP client.
404 is the right ...
- 14.8k
7
votes
What reasons are there AGAINST using only POST HTTP verb in an API?
I added this comment here, but I wanted to elaborate on my reasoning in an answer.
When we talk about APIs, usually we mean remote APIs, especially HTTP REST APIs. But API stands for Application ...
- 171
7
votes
How to handle large file uploads in Angular and Hibernate without exceeding HTTP request size limit?
HTTP requests most definitely can be configured on the server side to be limitless. However that won't help you much because JSON cannot be processed as a stream, or at least it is hard. Typically ...
- 2,604
6
votes
Accepted
How to limit the amount of requests by minute to a external system on a micro services environment?
I think this is all about resilience :)
What happens, if the request limitation is reached? Will "responsys" just throw an error or really tell the calling microservice that it hit the limit? Will ...
- 201
6
votes
Client-side XHR request, which IP does the endpoint read?
The browser will download the contents of the JavaScript file and execute it - this all happens on the client's machine, so the XHR request will have the IP address from the client. It doesn't really ...
- 3,157
6
votes
Accepted
How do I create an HTTP PUT request that modifies the resource in many ways
A PUT request should completely replace the resource, so this is essentially a non-issue. If you want to update multiple aspects while keeping some information, PATCH is the right verb to use, and you ...
6
votes
How to map "mv" operation to HTTP verbs?
One possible solution might indeed be to drop that "should not (imho) imply a DELETE".
While it is somewhat counterintuitive that a constructive REST verb (POST) could have a destructive ...
6
votes
GET vs POST when exposing machine learning model predictions using a REST API
if my prediction method requires some sort of data that will never be placed in the URL (like a json string), I can send it in the body of the GET request the same way I can with a POST request
That ...
- 8,445
6
votes
Accepted
parameter longer than the length limit of GET into a RESTful interface
use GET, but put the parameter in request body other than request url.
Out of bounds
A payload within a GET request message has no defined semantics -- RFC 7231.
The problem is that general purpose ...
- 33.7k
Only top scored, non community-wiki answers of a minimum length are eligible