Tag Info

Hot answers tagged

2

I've seen good APIs designed both ways. On the one hand, providing the userId in authentication and the URL seems redundant. On the other hand, it could be more consistent to have an explicit Id in the URL if there are also ways for one user to look at public data of another user or you are using the same or a similar API in clients that need to get data ...


1

You are facing a trade-off between two design principles: first, simplicity/consistency: your original approach has the advantage that the names and structure correspond better to your server-side structures, what saves you some mapping effort. For example, imagine you introduce a color attribute into the Group resource later. So your first approach now ...


1

This is a lot like asking why we have both a username and a password for all our regular internet accounts, when arguably just a password is sufficient. The first reason is actually contained in your question: Actually I would considered using a single API ID is more secure - since when you change , it is more hard to identify the client (as there is no ...


1

There are basically two different questions in one. Let me simplify and rephrase them: 1. If you have userId once as authentication info and once as a part of a data object which one should win? None of them should win. These are two different userIds one is user performing the action another is the data object user as a subject of the action. Think of ...


1

No. Strings are always null-terminated by definition, the string length is redundant. Non-null-terminated character data should never be called a "string". Processing it (and throwing lengths around) should usually be encapsulated within a library, and not part of the API. Requiring the length as a parameter just to avoid single strlen() calls is likely ...



Only top voted, non community-wiki answers of a minimum length are eligible