71–80 of 82 posts
Obvious question: How to protect against this ?
Earlier quoted context omitted.
> It's not very, let's say, RESTy. It has only one endpoint, To be fair, from what I understand an actual(tm) REST API would only have a single defined endpoint[1]: the entry point. With every other endpoint being discovered from the responses. And also from your message I'm guessing a URI still uniquely identifies a resource (specifically through the "query" part of the URI, instead of the more common "path"). So, t…
This is HATEOAS, basically the core feature of REST that very few people actually use. Most of what the industry calls REST or RESTful is just structured and inefficient RPC.
Earlier quoted context omitted.
> It's not very, let's say, RESTy. It has only one endpoint, To be fair, from what I understand an actual(tm) REST API would only have a single defined endpoint[1]: the entry point. With every other endpoint being discovered from the responses. And also from your message I'm guessing a URI still uniquely identifies a resource (specifically through the "query" part of the URI, instead of the more common "path"). So, t…
I don't think anyone has ever used REST in the way you are using it - the sibling comment points out that HATEOAS is probably what you mean - this generally embeds links to all resources, full data navigation, next/prev links, and so on. It is true that a proper HATEOAS client should be able to navigate an endpoint completely with just a starting address.
did i miss something or why are there TWO (2) "magically reverse engineer REST APIs" projects on the HN front page right now? is there some offline beef going on? (screenshot in case this goes away https://x.com/swyx/status/1874762725383188502 )
Earlier quoted context omitted.
I curious as to why people would have a public API to begin with if they wanted to protect it from people using it. Then again, why would anyone have a public undocumented API in 2024 when a LLM can give you a cli tool to auto-generate 90% of the OpenAPI spec in a couple of hours? The last question isn't serious, I've worked in enterprise for decades and almost none of the tools organisations end up buying have good…
I think you have a misunderstanding here. The API needs to be "public" because the app uses the internet to communicate back to the home server. The API is not "public" in the sense that the app developers want anybody to use it; they just want their app to use this API. So they don't write publicly accessible documentation about it because they don't want to encourage its use. A tool like MitmProxy2Swagger lets you…
Earlier quoted context omitted.
I think you have a misunderstanding here. The API needs to be "public" because the app uses the internet to communicate back to the home server. The API is not "public" in the sense that the app developers want anybody to use it; they just want their app to use this API. So they don't write publicly accessible documentation about it because they don't want to encourage its use. A tool like MitmProxy2Swagger lets you…
Why wouldn’t you add authentication to an API you don’t want others to use?
Earlier quoted context omitted.
I think you have a misunderstanding here. The API needs to be "public" because the app uses the internet to communicate back to the home server. The API is not "public" in the sense that the app developers want anybody to use it; they just want their app to use this API. So they don't write publicly accessible documentation about it because they don't want to encourage its use. A tool like MitmProxy2Swagger lets you…
Why wouldn’t you add authentication to an API you don’t want others to use?
How many apps have you seen only do client-side protection?
did i miss something or why are there TWO (2) "magically reverse engineer REST APIs" projects on the HN front page right now? is there some offline beef going on? (screenshot in case this goes away https://x.com/swyx/status/1874762725383188502 )
Offtopic and meta, but, you share a screenshot using Twitter/X? That's really bizarre to me. That is all, just had to say that.