HyperText Transfer Protocol

learn more… | top users | synonyms

7
votes
3answers
2k views

Are there any problems with implementing custom HTTP methods?

We have a URL in the following format /instance/{instanceType}/{instanceId} You can call it with the standard HTTP methods: POST, GET, DELETE, PUT. However, there are a few more actions that we ...
1
vote
1answer
96 views

Is it safe to generate client nonces using random number generator?

I am making HTTP calls on the client side and the server expects me to supply a client nonce. It needs to be 4 bytes long. I am planning to use this combination: base64(parts of the MAC address + ...
0
votes
0answers
3 views

What method call in HttpsURLConnection actually sends the HTTP request? [migrated]

I am new to the HttpsURLConnection class in java, and looked on the doc and found it not very enlightening. I have inherited this code on a project I am working on (I did not write it myself) and ...
0
votes
1answer
182 views

HTTP Session: A single object or multiple?

I tested two approaches to store session data: The classic: 1 key, 1 object (And every key as static final String in a class) "user" --> UserObject "preferences" --> List ... An ...
0
votes
0answers
30 views

How to publicize new Android's HTTP requests library [duplicate]

I don't know if this really belongs here, but I developed an open-source HTTP requests library for Android called Unite. This library was built mainly to significantly facilitate the work and coding ...
0
votes
0answers
42 views

How does session middleware generally verify browser sessions?

I've been using session middleware to build web apps for years: from PHP's built-in session handling layer to node's connect session middleware. However, I've never tried (or needed) to roll my own ...
0
votes
3answers
156 views

POST and PUT requests – is it just the convention?

I've read quite a few articles on the difference between POST and PUT and in when the two should be used. But there are still few things confusing me ( hopefully questions will make some sense ): 1) ...
1
vote
0answers
99 views

Has RFC2324 been implemented? [closed]

I know RFC2324 was an April Fools joke. However, it seems pretty well thought out, and after reading it I figured it wouldn't be out of the question to design an automated coffee machine that used ...
3
votes
2answers
115 views

Why do XML namespace URIs use the http scheme?

A XML namespace should be a URI, but it can use any URI scheme, including those that are not URLs. Then why do all widely used XML namespaces use the http scheme (e.g. ...
1
vote
1answer
40 views

Is it RESTful to resume terminated POST operation on a GET request?

I have a RESTful API, one of the resource has a state that is determined collectively by multiple servers, not all of them belong to us. One of the operation on this resource will have to modify the ...
2
votes
2answers
133 views

How to indicate to a web server the language of a resource

I'm writing an HTTP API to a publishing server, and I want resources with representations in multiple languages. A user whose client GETs a resource which has Korean, Japanese and Trad. Chinese ...
0
votes
0answers
55 views

RESTful composition/inclusion of other resources

I have a few HTTP resources, and i'm wondering if including the models of one in the other is acceptable or if there is a cleaner method. In this example, we have a ton of "news" resources, and users ...
3
votes
2answers
106 views

Why HTTP Servers send information about themselves in HTTP Headers?

Most of the HTTP Servers I know send their application name and version in response http headers as default behaviour. (Nginx, IIS, Apache etc.) Of course we can change the default behaviour but I ...
-1
votes
3answers
145 views

A RESTful way to verify server state [closed]

I'm interested in building verifications into a REST service to help with service monitoring. For example, one could run assertions like ...
0
votes
0answers
79 views

Multiple long polling requests: bad idea?

I am designing a web server that handles multiple things such as a user-to-user chat, a user-to-group chat, friends request, forum etc. The chats have to be real-time chats, the friends requests ...
1
vote
1answer
72 views

JSF problems due to shared server-side state

On it's latest technology radar, the guys at ThoughtWorks recommended avoiding JSF because it's attempt to create statefulness over HTTP ends up "causing a whole host of problems involving shared ...
27
votes
3answers
1k views

What does HATEOAS offer for discoverability and decoupling besides ability to change your URL structure more or less freely?

Lately I've been reading about Hypermedia as the Engine of Application State (HATEOAS), the constraint that is claimed to make a web API "truly RESTful". It boils down to basically including links ...
0
votes
3answers
196 views

Why don't http headers include device resolution, pixel density, etc.?

I'm currently developing a responsive website with css media queries. It would be much easier if the server returned a different html/css for each viewport. I was wondering why couldn't the client ...
1
vote
2answers
138 views

Should I use HTTP search

I am working on a web api and I am curios about the HTTP SEARCH verb and how you should use it. My first approach was, well you could use it surely for a search. But asp.net WebApi doesn't support ...
3
votes
1answer
94 views

Invalid data returned, which HttpCode to return?

My web application calls a third party API. If I successfully call the API but invalid data is returned which cannot be processed by my system what is the most appropriate HttpCode to return to the ...
1
vote
2answers
220 views

What is the applicability of CORS?

I have a system which needs to do cross-origin requests and having trouble understanding the relevance of CORS. At first glance it doesn't appear to provide me with any type of security I'd actually ...
0
votes
0answers
55 views

How to have my callbacks authenticated in a REST app?

I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the ...
0
votes
0answers
129 views

How can resolve an URL on a specific DNS server

I'm currently facing a issue on a project. I'm resolving URL's on multiple DNS servers using a node.js server. Until here, everything is fine. But some ISP restrict the incoming requests from IPs ...
0
votes
0answers
231 views

Django web app with websockets

I want to make a web service using Django, but that also has websocket functionality. Having done a bit of reading, this is the tech stack that I'm looking at: --------------------------------- ...
-2
votes
3answers
107 views

Why speaks basic http authentication always of a username

In RFC 2617 HTTP Authentication: Basic and Digest Access Authentication they speak always of username and password for the authentication. Why should I choose to take a username as identifier for a ...
1
vote
1answer
72 views

What HTTP status codes need to be checked for this network task to perform smoothly?

My office department logs in to the ISP Server through a keep-alive-browser login page. This, for better performance, is encapsulated in to a small python script. This is what it does (Pseudo code) ...
4
votes
1answer
114 views

What HTTP verb is appropriate for an api route that restarts an application the server?

I got asked to do a code review of a very simple one-route web service that when hit would simply restart an application on the system. The developer had coded this up as a POST which strikes me as ...
3
votes
2answers
85 views

How should I specify locations where clients can resolve authorization problems in a REST API?

I'm working through an API design where a user's authentication will be verified by the presence of a valid forms authentication ticket in a session cookie. However, there are additional levels of ...
3
votes
3answers
1k views

Why REST Api do not follow the Facade design pattern

In comparing REST [api] structure with a OO model, I see these similarities: Both: Are data oriented REST = Resources OO = Objects Surround operation around data REST = surround VERBS (Get, ...
0
votes
1answer
225 views

Rest API Architecture from Rest in Practice book

We maintain an API that as part of its purpose makes a call to an external API. This external API takes a few seconds to fulfil the request we make to it. With our current architecture the request is ...
9
votes
5answers
1k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
5
votes
2answers
777 views

Should I make up my own HTTP status codes? (a la Twitter 420: Enhance Your Calm)

I'm currently implementing an HTTP API, my first ever. I've been spending a lot of time looking at the Wikipedia page for HTTP status codes, because I'm determined to implement the right codes for ...
3
votes
4answers
676 views

PHP - Internal APIs/Libraries - What makes sense?

I've been having a discussion lately with some colleagues about the best way to approach a new project, and thought it'd be interesting to get some external thoughts thrown into the mix. Basically, ...
5
votes
2answers
2k views

Comparing TCP/IP applications vs HTTP applications [closed]

I'm interested in developing a large-scale user-facing website that is written in Java. As for design, I'm thinking of developing independent, modular services that can act as data providers to my ...
2
votes
1answer
276 views

PHP high traffic default page

I have a php website that will be experiencing high levels of traffic in a few weeks. We scaled the servers to accept the traffic, but want some sort of fallback page in the event that something ...
13
votes
12answers
2k views

Understanding the stateless internet [closed]

I'm transitioning from being a desktop developer to a web developer, and I'm having trouble understanding why HTTP is stateless. What are the reasons for it? What are some ways a desktop developer ...
2
votes
3answers
104 views

Specifying the format in which I want to get a response through POST

It's a good practice to let a client specify the format in Web REST API: GET /api/items/123.csv However, not only GET can return some answer, but POST also can do Status: 201 Created { mgs: ...
13
votes
1answer
612 views

Why do some websites showing 0 bytes in Chrome's developer tools

I am doing a page speed optimization for my website and studying how other websites do it. I noticed that some websites such as as Facebook or Ringgitplus show 0 bytes for some of their resources in ...
5
votes
3answers
658 views

How can I send audio input as chunked HTTP?

I am trying to create an interface with an external server, and don't know where to start. I would need to take audio as input to my computer, and send it to the remote server as a chunked HTTP ...
10
votes
1answer
1k views

Generate commercial license key for web service

Background I have a business question regarding web-based software licensing. A number of web sites offer software as a service for various APIs. A good example is Google's Custom Search API. The ...
7
votes
2answers
2k views

How should a REST API handle PUT requests to partially-modifiable resources?

Suppose a REST API, in response to a HTTP GET request, returns some additional data in a sub-object owner: { id: 'xyz', ... some other data ... owner: { name: 'Jo Bloggs', role: ...
2
votes
2answers
299 views

Should an Http API always return a body?

Is there some sort of standard regarding http api responses? After reading this discourse thread I started to wonder. We are developing our public http json api at my work, and we do not return ...
2
votes
2answers
2k views

Is it safe to transmit access tokens via HTTP headers?

It's the first RESTful web service and I am concerned about security issues. Is it safe to transmit my access token via HTTP headers? For example: POST /v1/i/resource HTTP/1.1 Content-Type: ...
12
votes
2answers
4k views

Suggested HTTP REST status code for 'request limit reached'

I'm putting together a spec for a REST service, part of which will incorporate the ability to throttle users service-wide and on groups of, or on individual, resources. Equally, time-outs for these ...
0
votes
1answer
424 views

Python web application frontend for equipment diagnostics and interaction

My goal is to have a Python application that runs a web server which hosts the user interface, and based on interactions from a user in their browser, long running tasks get kicked off and through ...
0
votes
0answers
153 views

Talking between Web Applications and Desktop Applications

So I have been thinking of the best way to implement a native desktop app that can print from data generated via a Web App. The method I have come up with looks much like this. From the End User ...
1
vote
2answers
147 views

Queuing RPC calls

I'm designing a system which listens to JSON RPC calls from clients, piles them up inside a list, and if the list gets full it will store them in a DB and keep receiving calls. My original plan is to ...
18
votes
8answers
2k views

When to use HTTP status code 404 in an API

I am working on a project and after arguing with people at work for about more than a hour. I decided to know what people on stack-exchange might say. We're writing an API for a system, there is a ...
4
votes
2answers
790 views

What can REST API do that a API using HTTP URL query strings cannot do?

I'm learning about REST and had the chance to build a basic REST API. After doing so, most of the material I read was internalized and I now have a better understanding of it. However, I do not ...
1
vote
2answers
298 views

Preventing Web Site Users From Using Their Back Button To Get To Cached Screens After Logging Out?

I have a legacy Java webapp ( Spring 3.1 MVC, legacy servlest and JSPs ) I have modified to log the user out after s/he clicks an external link to leave the web site. The last screen(s) s/he was on ...