REST is acronym for REpresentational State Transfer. And REST API is an application which communicates with the clients using http-protocol. The client can be a web-application, or Mobile application or any application which is abel to use http. The REST API will handle the connection to the database.
A REST API or a RESTful API is an application program interface (API) that uses HTTP requests to GET, PUT, POST and DELETE data.
You can read more about it from:
Can we use MVC in REST API? Yes, partly. We can implement the Model and the Controller to the REST API and then the View-part will be a separate application. The View can be a mobile application, or a web-application, or a desktop-application.
Within computer programming, the acronym CRUD stands for create, read, update and delete. These are the four basic functions of persistent storage. Also, each letter in the acronym can refer to all functions executed in relational database applications and mapped to a standard HTTP method, SQL statement or DDS operation.
Quite often we implement all CRUD operations to the REST API.
HTTP(Hypertext Transfer Protocol) is a protocol which is used to transfer files over the ip-network. Here is a good tutorial about http https://developer.mozilla.org/en-US/docs/Web/HTTP/Overview.
HTTP messages means the data that is exchanged between a server and a client. There are two types of messages:
Http message includes allways headers and it can also include a body. You can find a list of http headers from https://tools.ietf.org/html/rfc4229.
In REST API we can use these Http methods:
When you are making a REST API, it is important to know that when you are using GET-method, you have to insert the data inside the header and when you are using POST-method, you have to insert the data inside the body.
Example if you want to send a variable named fname, with a value Jim using GET-method, then the url will be something like
http://localhost/api/?fname='Jim'
But if you are using POST-method then, the url is just like this
http://localhost/api
When we are using DELETE, we will add the id to the url on the same way as in GET-method. And when we are using PUT, we will add the id to the url and the update data to the body.
A common way to build a REST API is that, you don't have to include the variable names in your GET-requests. So that instead of this kind of url
http://localhost/api/?id=5
you can just type http://localhost/api/5
You can read more about those methods from:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods
http://www.restapitutorial.com/lessons/httpmethods.html
The http response includes status code, which gives information about the response. The most important classes of the codes are:
You can read about the status codes from:
https://www.restapitutorial.com/httpstatuscodes.html
HTTPS(Hypertext Transfer Protocol Secure) is an extension for the HTTP. If you use HTTP, all the information will be transfered in plain text format. But if you use HTTPS, the information will be encrypted.
Authorization is one of the fields in http headers. There are several authorization types and in the examples of this website I am describing http Basic-authorization and Webtoken-authorization.
Using authorization means that we will protect our REST API (or some routes in the API) with username and password. And then the client will have to send the right credentials: username and password inside the http headers. If the client don't send valid the credentials, the server will response 401 Unathorized.
REST allows different messaging formats, such as HTML, JSON, and XML. This tutorial is focused on JSON (JavaScript Object Notation). JSON is very lightweigth format.
JSON objects are written inside curly brackets. Example like this
{ "id_book": 11, "name": "New Book", "author": "Mike", "isbn": "22" }
JSON arrays are written inside square brackets. And the array can contain objects. Like this
[ { "id_book": 11, "name": "New Book", "author": "Mike", "isbn": "22" }, { "id_book": 7, "name": "Signal Slot", "author": "Jim Bim", "isbn": "2345-66" } ]
Quite often the serverside and clientside code are separated, so that they will have different URL's. So we have to allow the http requests, which comes from different URL. And this we can manage with a system called CORS (cross-origin resource sharing).
Authentication and authorization are two vital information security processes that administrators use to protect systems and information. Authentication verifies the identity of a user or service, and authorization determines their access rights.
The purpose of authentication is to verify that someone or something is who or what they claim to be.
Authorization is the security process that determines a user or service's level of access. In technology, we use authorization to give users or services permission to access some data or perform a particular action.
In the context of an HTTP transaction, basic access authentication is a method for an HTTP user agent (e.g. a web browser) to provide a username and password when making a request. In basic HTTP authentication, a request contains a header field in the form of Authorization: Basic <credentials>, where credentials is the Base64 encoding of ID and password joined by a single colon :.
JWTs or JSON Web Tokens are most commonly used to identify an authenticated user. JWT authentication follows a 4 step process: