Skip to main content
244 votes

Why should 'boneheaded' exceptions not be caught, especially in server code?

Silent But Deadly When writing enterprise software, you will eventually learn an essential truth: the worst bug in the world is not one that causes your program to crash. The worst bug in the world ...
Lawnmower Man's user avatar
106 votes

When would you use a long, string ID instead of a simple integer?

Youtube can't use sequentional IDs for two reasons: Its databases are almost certainly distributed, making sequential numbering complicated. It has a privacy option "Unlisted videos": those that don'...
IMil's user avatar
  • 849
104 votes
Accepted

Should you guard against unexpected values from external APIs?

You should never trust the inputs to your software, regardless of source. Not only validating the types is important, but also ranges of input and the business logic as well. Per a comment, this is ...
Paul's user avatar
  • 3,317
81 votes

When would you use a long, string ID instead of a simple integer?

On the form of the IDs: They're using Base64 (using the characters a-z, A-Z, 0-9, -, and _). This allows them to have 6 bits of information per character. YouTube uses 11-character video IDs, which ...
rchard2scout's user avatar
71 votes
Accepted

What is the present-day significance of SOAP

REST is indeed an architectural style. SOAP is a data protocol. The distinction is important; you cannot compare them directly. The primary purpose of REST is to represent resources on the Internet,...
Robert Harvey's user avatar
59 votes

Why should 'boneheaded' exceptions not be caught, especially in server code?

Exceptions should be allowed to crash the system if the system has been left in an unrecoverable undefined state. If you can't put the system back in a defined state that ensures data integrity and ...
candied_orange's user avatar
45 votes
Accepted

Should I return a 204 or a 404 response when a resource is not found?

HTTP 204 means that something was found, but it's empty. For instance, imagine that you're serving log files through HTTP, with the requests such as http://example.com/logs/[date-goes-here]. On May ...
Arseni Mourzenko's user avatar
44 votes

Why not use SQL instead of GraphQL?

Basically, abstraction. SQL requires your clients to know your exact database structure, which is not good. On top of that, analysing the SQL in order to perform special operations based on the value ...
Andy's user avatar
  • 10.4k
43 votes

Why should 'boneheaded' exceptions not be caught, especially in server code?

It doesn't really matter if it's a "boneheaded" exception (e.g. a Java unchecked exception) or not. The only question to ask yourself is: "Can the program sensibly continue?" A &...
Paul Draper's user avatar
  • 6,022
35 votes

What is the present-day significance of SOAP

REST is much more limited than SOAP, which is its strength and the reason for its popularity. In SOAP, the set of operations allowed and the set of data types allowed is essentially limitless. SOAP ...
Joeri Sebrechts's user avatar
34 votes

If a microservice architecture needs a separate database per microservice then it's too costly & unmanageable. Why do we even need it?

Why do we even need it? You don't. Creating a separate database for each service helps to enforce domain boundaries, but it's only one approach. There's nothing stopping you from having all your ...
Dan Wilson's user avatar
  • 3,113
34 votes

Should you guard against unexpected values from external APIs?

Yes, of course. But what makes you think the answer could be different? You surely don't want to let your program behave in some unpredictable manner in case the API does not return what the ...
Doc Brown's user avatar
  • 210k
33 votes

I'm not seeing 'tightly coupled code' as one of the drawbacks of a monolithic application architecture

Why X when you can do Y? The problem with questions like these is that no one has ever claimed that you can't take the more difficult route if you really want to. People aren't pointing out that the ...
Flater's user avatar
  • 52.7k
32 votes

Why not use SQL instead of GraphQL?

In theory there is no reason you can't expose an SQL interface like this. In practice SQL is far too powerful to be effectively limited to the security scope you want to expose. Even if you allow ...
Ewan's user avatar
  • 77.5k
26 votes

Should you guard against unexpected values from external APIs?

The Robustness Principle--specifically, the "be liberal in what you accept" half of it--is a very bad idea in software. It was originally developed in the context of hardware, where ...
Mason Wheeler's user avatar
23 votes

Why should 'boneheaded' exceptions not be caught, especially in server code?

You are absolutely correct. An exception in server-side application code ("boneheaded" or not) should not crash a web server. The confusion is because the articles are not clear about what it ...
JacquesB's user avatar
  • 59.9k
22 votes
Accepted

Handling token renewal / session expiration in a RESTful API

This sounds like a case of authentication versus authorization. JWTs are cryptographically signed claims about the originator of a request. A JWT might contain claims like "This request is for user X"...
Jack's user avatar
  • 4,509
18 votes

Why should 'boneheaded' exceptions not be caught, especially in server code?

You learned an important thing: Whenever you read a rule on the internet that must absolutely be followed, you must start thinking about it and decide for yourself whether you should follow the rule ...
gnasher729's user avatar
17 votes

Handling token renewal / session expiration in a RESTful API

Your API session is a thing which should not exist in a RESTful world at all. RESTful operations are supposed to be stateless, session contains state and thus has no place in a RESTful world. The JWT ...
Andy's user avatar
  • 10.4k
17 votes

If a microservice architecture needs a separate database per microservice then it's too costly & unmanageable. Why do we even need it?

Why do we even need it? The enormous benefit of microservices—and more largely, SOA—is the high level of abstraction of the internals—not only the implementation, but also the technologies being used....
Arseni Mourzenko's user avatar
15 votes

When would you use a long, string ID instead of a simple integer?

Integers do not scale that well, a "normal" 32-bit unsigned integer will max out just over 4 billion. They may not want you to know how many items they have on line or keep track of the ...
Martin Maat's user avatar
  • 18.5k
14 votes

Should you guard against unexpected values from external APIs?

In general, code should be constructed to uphold the at least the following constraints whenever practical: When given correct input, produce correct output. When given valid input (that may or may ...
supercat's user avatar
  • 8,583
13 votes
Accepted

How to design a REST API to handle non-CRUD operations?

You need to watch this talk by Jim Webber. When I need to update the state of the subscription, I cannot simply send a POST request to the server, because I don't have direct access to the resources, ...
VoiceOfUnreason's user avatar
11 votes

If a microservice architecture needs a separate database per microservice then it's too costly & unmanageable. Why do we even need it?

As Dan Wilson answers, you don't really need it. Microservices are the new hot thing, and like all new hot things, people use them in a lot of places even when they don't provide much value. ...
Telastyn's user avatar
  • 109k
11 votes
Accepted

How does user authorization work in a Microservice architecture

When developing and deploying actual micro services, you do not want your consumer to access the microservices directly for several (main) reasons: it introduces heavy coupling on the client to your ...
Andy's user avatar
  • 10.4k
10 votes
Accepted

Proper RESTful web service response code usage

The user is the resource and if it's not there you return 404 resource not found. The URI is the representation of the entity. That's the whole point. 404 means the server was contacted and they ...
Fran's user avatar
  • 859
10 votes
Accepted

Is it okay to use static classes while creating a wrapper for REST API?

Static class methods are basically global functions, and are considered a bad idea in OO design. The reason why they are considered bad is hard to see in a simple code example where you are just ...
Cormac Mulhall's user avatar
10 votes

Architecture for OAuth2 - BackendServer - FrontendServer

First, you will need **HTTPS**. HTTPS = HTTP + SSL/TLS. It creates a security layer on top of your HTTP and prevent a lot of attacks. For that layer to work you will need to trasmit and receive ...
linuxunil's user avatar
  • 1,451
10 votes

When would you use a long, string ID instead of a simple integer?

1) Why do some websites use letters in their IDs? Are they strings? We don't know if those websites store IDs in their database as strings. Numbers and strings are really the same to computers. A ...
Jasmijn's user avatar
  • 1,859
10 votes

Why not use SQL instead of GraphQL?

Because almost nobody understand that SQL != RDBMS != Relational model. SQL is just a query language. It does not even need a relational database system. It is not fully relational either. It also ...
mamcx's user avatar
  • 432

Only top scored, non community-wiki answers of a minimum length are eligible