HyperText Transfer Protocol

learn more… | top users | synonyms

0
votes
2answers
18 views

Secure authentication using JWT

I read about JWT and how they can provide secure authentication for calling api routes over http. I naively implemented it and here is how it goes : a client posts username and password to a login ...
3
votes
2answers
149 views

How are POST/PUT/DELETE data passed to APIs?

I know that the data is passed through HTTP, but I'm not sure if I should be passing data through HTTP headers, or HTTP bodies. Which one is the convention for APIs? Also, theoretically using PHP, ...
5
votes
3answers
191 views

Microservices and isolated data storage models [duplicate]

I have been looking at Microservices for a while now. The concept is not new but it's communicated in a lightweight manner. So, I am very excited about this. However, there is a question that I am ...
26
votes
3answers
830 views

Should I use HTTP status codes to describe application level events

Several servers I have dealt with will return HTTP 200 for requests that the client ought to consider a failure, with something like 'success : false' in the body. This does not seem like a proper ...
0
votes
1answer
95 views

What encoding are the HTTP status and header lines?

If I was going to write a parser for HTTP, would I be able to assume the encoding of the HTTP headers and status line? Until I read the charset or encoding header, how could I tell what the encoding ...
0
votes
2answers
109 views

Should my public webservices use HTTP or HTTPS?

The situation is a bit more complex than the title suggests (but not much). I'm working on a REST API that will have a few open / publicly available resources and a few with authentication. (The ...
2
votes
1answer
82 views

Load testing HTTP server with large number of concurrent connections

I'm trying to load test/benchmark a http server with a very large number of simultaneous connections (10-100k). What is a good procedure for doing this? On linux I've seen that both the client and ...
0
votes
1answer
40 views

Where should I log in the user based on http session: service or controller?

I know that best practice is to let everything about authentication/authorization to the service layer. Controller should not be aware of that. But how to let a service (from service layer so) to ...
1
vote
1answer
45 views

What mechanism/protocol transmits non-HTML files when downloaded from the web?

When a non-HTML file such as a PDF, DOCX, EXE, etc is made public to the WWW by an HTTP server, and a client makes a request for said file, www.example.com/download?=test.doc what facilitates the ...
3
votes
1answer
66 views

Image resolution in a RESTful interface

Background I have a RESTful HTTP API. I have a resource. GET /my/cat HTTP/1.1 Clients may want to retrieve the image representation of this resource. GET /my/cat HTTP/1.1 Accepts: image/png ...
0
votes
3answers
140 views

Would it be possible to transfer an HTML file using a protocol different from HTTP?

I am reading about internet and stuff and just learned that web pages are really just HTML files. Also, I have learned that HTTP is just a transfer protocol. So my question is, would it be possible ...
0
votes
1answer
76 views

Should http requests be in the constructor or in a static function? [closed]

Which is conventional? For example, this is in the constructor: public class Foo { ... public Foo(...) { // http requests } ... } and this is in the static method: public class Foo ...
2
votes
1answer
132 views

Is HTTP 426 acceptable for “Your request should have been HTTPS”

I have an HTTP serving an API which works either anonymously or with a secret key in a header, like so: GET /profile?authenticationKey Authorization: 1234567890 I want to reject any request coming ...
0
votes
2answers
101 views

REST Service Description in a Hypermedia agnostic way?

How do I implement REST service description in a Content-type agnostic way? Background I am developing a RESTful API for Web Application. Now this app is somewhat different than a standard ...
0
votes
0answers
73 views

Inclusive vs exclusive end for Java API for HTTP range requests

Java programmers typically expect the end index of a range to be excluded, as discussed in this question. For example string.substring(500, 1000) requests characters 500 through 999 inclusive of the ...
2
votes
2answers
83 views

How should an HTTP server respond to a GET of an absolute URI of a different server?

I'm implementing a custom HTTP 1.1 server. According to Page 35 of RFC 2616, an HTTP Request URI may take one of four forms. One of these forms is "absolute-URI", which is exactly what it sounds like. ...
1
vote
1answer
60 views

Cross application cookie access

It was my understanding that cookies are transferred with each subsequent http request, yet if I log in to a web application that uses cookie authentication, say on my browser, other applications on ...
0
votes
0answers
48 views

Spring pass-through authentication mechanism

I want to implement a "pass-through" authentication system using Java and Spring. I want to create a service that will be transferring all incoming http requests to a different host/port where ...
1
vote
0answers
177 views

Design pattern for socket.io and Express

I have a Node.js Express RESTful HTTP server I will call server A and an Express socket.io server I will call server B. Server A responds to all HTTP requests by clients and server B listens to the ...
5
votes
8answers
606 views

Is it okay to return the “wrong” HTTP status code in order to show a more user-friendly error page?

Located here, RFC 7231 is all about the HTTP protocol (status codes) I'm developing an in-house web application for my university's department and I'm at a (probably unimportant) impasse. I'm ...
15
votes
1answer
373 views

Is progressive HTTP download a viable alternative to HLS/DASH/RTMP for providing live video?

I'm working on a website that needs to stream live video to users, and as such I've had to get my head around the sorry state of current browser-based video-streaming technology. The most popular ...
4
votes
1answer
108 views

How should I handle a HTTP response whose body takes time to generate, and whose headers cannot be determined until generation is complete?

Background My web application lives on a centralised server in the product's "network", and provides the means to manage/configure various distributed devices. The server also logs various statistics ...
3
votes
3answers
494 views

Recommended HTTP status code for “plan limit exceeded” response

I'm designing a REST API for a project where users are always on one of several "plans" - each plan defines some resource limits, such as the max number of users an account may have or the max number ...
0
votes
1answer
67 views

REST API - Updating a Variable

If you are updating a variable in a RESTful API, for example person's weight, how should this be laid out? What I have thought of: PUT /person/1/weight?weight=150 PUT /person/1/weight {"weight": ...
0
votes
1answer
161 views

What is the middleware (if any) in web-service consumed by a website?

I am trying to identify the parts of an architecture. The server (Python) acts as a web-service, delivering files and data. The client (JS) requests the data which it needs by sending xmlhttprequests ...
0
votes
1answer
139 views

Alternatives to Request For Comments

I personally find RFC's quite difficult to read. They tend to be quite long, not precise enough, really old and for the most part, quite difficult to convert into actual working code. I think the ...
2
votes
3answers
132 views

Appropriate use case for “accepted”?

We have a task enqueued by a REST endpoint that will create a resource and then enqueue a task either immediately or delayed based on some business logic. I was thinking of using HTTP/1.1 200 OK for ...
1
vote
2answers
143 views

ID's in resource URLs: database id or per-user id?

For REST interfaces or webapps with nice-looking URLs, I constantly ask myself on what numbers to use if we want to refer to specific resources/pages. A typical approach seems to be to use the unique ...
4
votes
1answer
129 views

Why does SOP permit cross-origin form submissions?

Same Origin Policy does not prevent origin foo.bar from creating a form with action attribute set to another origin baz.duh and even allows to programmatically submit this form without the user ...
2
votes
1answer
100 views

HTTP API Versioning and Need to Introduce Breaking Changes to All Supported Versions

I am developing an HTTP application and deploying this by versioning it against the semantic versioning patterns/techniques/whatever they are. In order not to break existing clients and allow the ...
-2
votes
1answer
354 views

Crawler - programming language choice [closed]

I'm currently developing a web crawler. The first version was developed in Node.js and runs pretty well. The issues that I encountered with Node.js are in no particular order: slow URL and ...
-1
votes
2answers
123 views

In C is it possible to change http requests to https [closed]

Long story short I've got this package that currently has a security risk where credentials are sent over http and I need to convert them to https but I currently lack the knowledge to do so. Could ...
1
vote
1answer
117 views

How to avoid server-pushing assets to clients that already have them cached?

HTTP/2 server push enables pushing assets to clients which you anticipate they'll need in order to render the page. For example, you can push your CSS/JS/images to the client at the same time as you ...
0
votes
2answers
54 views

Android. HTTP Communcation, and GCM

I have an app that sends/receive data via HTTP POST, and communicates with PHP/SQL on the backend. I however wanted to integrate GCM to I can tell the app to "check for an update" to query the ...
1
vote
1answer
124 views

How does StackExchange load data from the server without making an XHR request?

When viewing the questions for a tag on SE networks, every now and then you will get a message at the top: n questions with new activity. However the weird thing (to me) is that I don't see any ...
4
votes
1answer
694 views

What belongs in an HTTP request header vs the request body?

I'm working on a set of web services for a mobile client, and the requirements call for a unique device id to be included with all requests, to be stored in certain requests, and used to filter ...
17
votes
6answers
2k views

What to call an HTTP API that is not RESTful? [closed]

What would you call an API that is HTTP-based, uses URI to name resources and HTTP verbs (PUT, POST, DELETE, GET...) to manipulate those resources? According to Roy Fielding's complaints it is not ...
0
votes
1answer
565 views

Detect request coming from iframe

I just had this awesome idea about simulating a single page application using iframes. I am using a framework that uses layouts to display pages. Luckily I can use an empty layout (meaning it has no ...
3
votes
2answers
74 views

Does sending system-profile information with HTTP GET request conform to RESTful practices?

I'm using the Sparkle framework to update an app, and want to make use of the framework's ability to send system-profile information. The way this is done is by adding the information to the HTTP GET ...
0
votes
2answers
115 views

comparison of computer processing language vs protocol

how can explain the diference between programming languge and protocol?, can protocol have extension? we know that machines communicate with protocol, but they can also do so with expressive ...
0
votes
2answers
131 views

Content delivery design

I'm designing a system where users can access files stored in an external content storage service such as AWS's S3. Here's a simple diagram: ------ ------------ ----------------- | User ...
2
votes
2answers
527 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
2answers
863 views

How should I provide detailed information about an error, if not through HTTP status codes?

This question comes from here. I believe it deserves to be on its own instead of being lost in a long question with multiple points. I'm building an API and find myself limited by HTTP error ...
1
vote
2answers
212 views

Should I specify the userId in the REST URL structure?

Basically, one feature of my app is to retrieve the logged user's friends. Actually, I hesitate between both kind of endpoints: GET /api/users/friends GET /api/users/:userId/friends Using 1, ...
0
votes
1answer
358 views

HTTP keep alive and TCP persistent connection

What's the relationship between the two concepts? Is one HTTP Keep-Alive connection always over a long persistent TCP connection? When the HTTP connection is closed, will the TCP connection be closed ...
1
vote
2answers
54 views

HTTP status code for mobile clients

There was a debate with one of the platform engineers (as a mobile dev), about the codes being returned. The scenario is: when trying to create a resource the server is returning a 201 with the ...
0
votes
0answers
286 views

Reason why client-side JavaScript does not allow access to POST/PUT/etc contents

Is there any theoretical reason why client-side JavaScript could not be spec'd to allow for direct access to POST or PUT contents without need for a server language to write it into client-side ...
1
vote
2answers
132 views

Do web applications use HTTP as a transport layer, or do they count as an integral part of the HTTP server?

Given an HTTP server (e.g. Apache, IIS) and a web application (user code running in the server using PHP, ASP.NET and the likes), which of those can decide which HTTP status code to return for any ...
2
votes
1answer
7k views

Two way Communication between Server and Clients

Situation: We have a web application running on a server. This application needs to fetch data from some other PC(Clients), which are on a different network. On the clients' pc there are WCF hosted ...
2
votes
1answer
94 views

Request content-type of HTTP errors

HTTP allows for multiple representations of a resource. The Accept header allows the client to choose the representation of the resource. GET /foo/bar HTTP/1.1 Accept: application/pdf GET /foo/bar ...