7 ms·

Yes, I think the normal way to integrate an app with an HTTP API is via the browser. Calling an external API from a backend that integrates directly with an cl

by DrFell 5y ago

Yes, I think the normal way to integrate an app with an HTTP API is via the browser. Calling an external API from a backend that integrates directly with an client app has been rare for me. Payment processing is all that comes to mind, and that was usually through an imported API package. I've made data scraping tools, but they were unique projects, not part of an app backend. I am a senior full-stack webdev.

motogpjimbo 5y ago
Has it ever occurred to you that your users can (a) see all requests you make to third party services, including your credentials and client secrets, (b) modify and replay those requests at will and (c) spoof responses from those services?
- DrFell 5y ago
  I think the misunderstanding is, beyond special cases like a payment processing, why would you be calling third party services from your service? When I think of calling a 3rd party HTTP API, I am thinking of public APIs, like say a widget that shows the weather in a users area.
  - motogpjimbo 5y ago
    I'm going to take a wild stab in the dark here and guess that despite having the title "senior", you have little or no experience in commercial software development? Because what you dismiss as "special cases" covers a vast amount of the plumbing of the modern web. In modern apps even something as simple as storing and retrieving files requires HTTP calls at some point in the stack, and such calls should never under any circumstances be initiated from someone else's computer. Which brings us back to the original question you responded to above. Contrary to your odd views of how software is architected, issuing HTTP requests from the backend is both normal and common enough to be banal. Node adopting the fetch API is generally a good thing as it allows JS developers to code against the same interface whether they are working from the frontend or the backend.
  - emteycz 5y ago
    Sure - but that weather/map/whatever widget might be paid, and unless you want to pay for others' API usage, you should make the relevant API calls from your backend, not frontend. Also consider caching 3rd party service replies, etc.

by DrFell 5y ago

motogpjimbo 5y ago

Has it ever occurred to you that your users can (a) see all requests you make to third party services, including your credentials and client secrets, (b) modify and replay those requests at will and (c) spoof responses from those services?

DrFell 5y ago
I think the misunderstanding is, beyond special cases like a payment processing, why would you be calling third party services from your service? When I think of calling a 3rd party HTTP API, I am thinking of public APIs, like say a widget that shows the weather in a users area.
- motogpjimbo 5y ago
  I'm going to take a wild stab in the dark here and guess that despite having the title "senior", you have little or no experience in commercial software development? Because what you dismiss as "special cases" covers a vast amount of the plumbing of the modern web. In modern apps even something as simple as storing and retrieving files requires HTTP calls at some point in the stack, and such calls should never under any circumstances be initiated from someone else's computer. Which brings us back to the original question you responded to above. Contrary to your odd views of how software is architected, issuing HTTP requests from the backend is both normal and common enough to be banal. Node adopting the fetch API is generally a good thing as it allows JS developers to code against the same interface whether they are working from the frontend or the backend.
- emteycz 5y ago
  Sure - but that weather/map/whatever widget might be paid, and unless you want to pay for others' API usage, you should make the relevant API calls from your backend, not frontend. Also consider caching 3rd party service replies, etc.