How Not to write a "REST" API
api.sharefile.com
How Not to write a "REST" API
1–10 of 117 posts
Re: How Not to write a "REST" API
#2Yeesh. According to this chart:
http://nordsc.com/ext/classification_of_http_based_apis.html
Sharefile is not even a HTTP API (since it doesn't use HTTP methods correctly).
For security purposes, authentication can be further increased by a POST of the "username" and "password" through the HTTP Headers as individual headers instead of the query string.
POST https://subdomain.sharefile.com/rest/getAuthID.aspx HTTP/1.1
Content-Type: application/x-www-form-urlencoded
password: yourpassword
username: email@address.com
What... I don't even...
Re: How Not to write a "REST" API
#3As a .Net developer I am a little bit ashamed to see the .aspx extensions in this API. We're not all like that... I swear. You believe me right?
Sadly, I can imagine how they got to this point. They were tasked to create an API and they did it with the knowledge and tools that they had.
Re: How Not to write a "REST" API
#4Most of the proprietary APIs I've had to work with were just as bad. Sometimes I wonder if the NDA they make you sign before seeing the API documentation is so that you won't be able to show anyone else how bad it is.
Re: How Not to write a "REST" API
#5Looks like an RPC-style API with multiple endpoints + custom authentication scheme.
Re: How Not to write a "REST" API
#6Looks like an RPC-style API with multiple endpoints + custom authentication scheme.
I was going to mention this. If this documentation completely removed the word 'REST' would we have cringed as bad?
Re: How Not to write a "REST" API
#7Looks like an RPC-style API with multiple endpoints + custom authentication scheme.
In other words, something you might hack together if you never really gave any thought into what makes a good API.
Re: How Not to write a "REST" API
#8Yeesh. According to this chart: http://nordsc.com/ext/classification_of_http_based_apis.html Sharefile is not even a HTTP API (since it doesn't use HTTP methods correctly). For security purposes, authentication can be further increased by a POST of the "username" and "password" through the HTTP Headers as individual headers instead of the query string. POST https://subdomain.sharefile.com/rest/getAuthID.aspx HTTP/1.1…
That is spectacularly bad, I wonder if they know RFCs exist.
Re: How Not to write a "REST" API
#9Yeesh. According to this chart: http://nordsc.com/ext/classification_of_http_based_apis.html Sharefile is not even a HTTP API (since it doesn't use HTTP methods correctly). For security purposes, authentication can be further increased by a POST of the "username" and "password" through the HTTP Headers as individual headers instead of the query string. POST https://subdomain.sharefile.com/rest/getAuthID.aspx HTTP/1.1…
As someone just starting to learn about secure restful web services: what is wrong with this security implementation of theirs?
Re: How Not to write a "REST" API
#10Yeesh. According to this chart: http://nordsc.com/ext/classification_of_http_based_apis.html Sharefile is not even a HTTP API (since it doesn't use HTTP methods correctly). For security purposes, authentication can be further increased by a POST of the "username" and "password" through the HTTP Headers as individual headers instead of the query string. POST https://subdomain.sharefile.com/rest/getAuthID.aspx HTTP/1.1…
As someone just starting to learn about secure restful web services: what is wrong with this security implementation of theirs?
[deleted]