0

An auth system I work on has this new function:

1. Auth system allows users to specify Relying Parties they transact with,

2. The Relying Party can approve/deny/maybe the request (authorisation) - maybe causes a redirect to the RP website for further authorisation questions by the RP.

The RP has to implement a web service specified by the Auth System to perform the approve/deny/maybe request that the auth system generates.

My problem is what this looks like as a REST service. As the auth system can't really dictate the URI style for the RP system, i would like to specifying that the path does not have any parameters in it, auth system just needs to know the URI of the service. The data of the request (user name/id) might be in a bit of json in the request body (suggesting POST http verb. GET might be OK, but loath to expose user ids in the URI). The auth system does not care what the RP does with the request data, the auth system just wants a "yes/no/maybe" reply (so may not really be a GET/POST/PATCH/DELETE/etc paradigm).

What would be the best verb to use? and how to facilitate the reply; its not really a success/failure response as there are 3 possible results to the query, is it acceptable to have some json returned with the response (then what http verb to use)?

I'm a bit baffled by this. GET seems the most obvious

GET /api/user_link_authorize/{userid}

except then i'm forced to put user ids in the URI (which I dont want to do)...

Any suggestions?

Anton Chertok
  • 13
  • 5
  • Why do you "loath" to expose user ids in the URI? They shouldn't contain PII (otherwise you should consider using a real id) and you should use authentication to confirm the requesting agent has access to that resource. – c1moore Jun 24 '19 at 01:47
  • why can't they just post with the user ID in the body? the response is always 200 (assuming properly formed body), and the response body contains the answer. I think you're too caught up in status codes. 401/3 means that the requester is not authorized to retrieve the information. In this case, the requester is authorized to view the information, it just may be that the info is "access denied"... in this context, think of 401/3 more of "im not telling if access is denied or not because i dont think you should have even that information" – bryan60 Jun 24 '19 at 01:59

1 Answers1

0

My problem is what this looks like as a REST service.

Think about how it would look as a web site.

You would start with some known URI in your list of bookmarks. Fetching that page would give you a representation of a form, which would have input controls that describe what data needs to be provided (and possibly includes default values). The client provides the data it knows about, and submits the form. The data in the form is used to create a HTTP request as described by HTML's form processing rules. The response to that request includes a representation of the answer, or possibly the next bit of work to be done.

That's REST.

Retrieving the form (via the bookmarked URI) would be a GET of course; we're just updating our locally cached copy of the forms "current" representation. Submitting the form could be a GET or a POST; we don't necessarily need to know that in advance, because that information is carried in the representation of the form itself.

GET vs POST involves a number of trade offs. Semantically, GET is safe, it implies that the resource can be fetched at any time, that spiders can crawl it, that accessing the resource in that way is "free". Which is great when the resource is free, because clients on an unreliable network can automatically retry the request if the response is lost. On the other hand, announcing to the world that the request is safe when it is actually expensive to produce responses is not a winning play.

Furthermore, GET doesn't support a message body (more precisely, the payload has no defined semantics). That means that information provided by the client needs to be part of the target resource identifier itself. If you are dealing with sensitive information, that can be problematic -- not necessarily in transit (you can use a secured socket), but certainly in making sure that the URI with sensitive information is not logged where the sensitive data can leak.

POST supports including a payload with the request, but it doesn't promise that the query is safe, which means that generic components won't know if they can automatically retry the request when a response is lost.

Given that you don't want the user id in the URI, that's a point against GET, and therefore in favor of POST.

Community
  • 1
  • 1
VoiceOfUnreason
  • 52,766
  • 5
  • 49
  • 91