(4) Architectural Styles

• Architectural Style vs. Architecture
  • Architectural Style: General principles informing the creation of an architecture
  • Architecture: Designing a solution to a problem according to given constraints
  • Architectural styles inform and guide the creation of architectures

Architecture: Louvre [http://en.wikipedia.org/wiki/Louvre] Architectural Style: Baroque [http://en.wikipedia.org/wiki/Baroque_architecture]

Architecture: Villa Savoye [http://en.wikipedia.org/wiki/Villa_Savoye] Architectural Style: International Style [http://en.wikipedia.org/wiki/International_Style_(architecture)]

(5) The REST Architectural Style

• A set of constraints that inform an architecture

1. Resource Identification [Resource Identification (1)]
2. Uniform Interface [Uniform Interface (1)]
3. Self-Describing Messages [Self-Describing Messages (1)]
4. Hypermedia Driving Application State [Hypermedia Driving Application State (1)]
5. Stateless Interactions [Stateless Interactions (1)]

• Claims: scalability, mashup-ability, usability, accessibility

(6) Resource Identification

• Name everything that you want to talk about
• Thing in this case should refer to anything
  • Products in an online shop
  • Categories that are used for grouping products
  • Customers that are expected to buy products
  • Shopping carts where customers collect products
• Client state transitions also are represented as resources
  • Performing a next step is also something you want to talk about
  • Next links on multi-page submission processes
  • Paged results with URIs identifying following pages

(7) Uniform Interface

• The same small set of operations applies to everything [Resource Identification (1)]
• A small set of verbs applied to a large set of nouns
• Verbs are universal and not invented on a per-application base
• If many applications need new verbs, the uniform interface can be extended
• Natural language works in the same way (new verbs rarely enter language)
• Identify operations that are candidates for optimization
  • GET and HEAD are safe operations
  • PUT and DELETE are idempotent operations
  • POST is the catch-all and can have side-effects
• Build functionality based on useful properties of these operations

(8) Self-Describing Messages

• Resources are abstract entities (they cannot be used per se)
  • Resource Identification [Resource Identification (1)] guarantees that they are clearly identified
  • They are accessed through a Uniform Interface [Uniform Interface (1)]
• Resources are accessed using resource representations
  • Resource representations are sufficient to represent a resource
  • It is communicated which kind of representation is used
  • Representation formats can be negotiated between peers
• Resource representations can be based on different constraints
  • XML and JSON can represent the same model for different users
  • Whatever the representation is, it must support links [Hypermedia Driving Application State (1)]

(9) Hypermedia Driving Application State

• Resource representations [Self-Describing Messages (1)] contain links to identified resources [Resource Identification (1)]
• Resources and state can be used by navigating links
  • Links make interconnected resources navigable
  • Without navigation, identifying new resources is service-specific
• RESTful applications navigate instead of calling
  • Representations [Self-Describing Messages (1)] contain information about possible traversals
  • The application navigates to the next resource depending on link semantics
  • Navigation can be delegated since all links use identifiers [Resource Identification (1)]

(10) Stateless Interactions

• This constraint does not say Stateless Applications!
  • For many RESTful applications, state is an essential part
  • The idea of REST is to avoid long-lasting transactions in applications
• Stateless interactions mean to move state to clients or resources
  • The most important consequence: avoid state in server-side applications
• Resource state is managed on the server
  • It is the same for every client working with the service
  • When a client changes resource state other clients see this change as well
• Client state is managed on the client
  • It is specific for a client and thus has to be maintained by each client
  • It may affect access to server resources, but not the resources themselves

(12) Resource Identification

• Early hypertext systems usually only identified documents within the scope of a single system (e.g. HyperCard)
• The web uses URIs (Uniform Resource Identifiers) as global identifiers
  • http://ischool.berkeley.edu/ [http://ischool.berkeley.edu/]
  • mailto:alexander.jones@ischool.berkeley.edu [mailto:alexander.jones@ischool.berkeley.edu]
  • tel:+1-510-684-2179 [tel:+1-510-684-2179]
  • urn:isbn:0451450523 [urn:isbn:0451450523]

Global naming leads to global network effects... the value of an identifier increases the more it is used consistently.

Architecture of the World Wide Web, Volume One [http://www.w3.org/TR/webarch/]

(13) URIs & Resources

• A URI identifies a resource
• But what is a resource?
• A resource is anything identified by a URI
• Resources are a way of conceptually dividing up some information space
• URIs do not merely identify; (often) they can be used to access or interact with a resource
• The details of how to do this are determined by the URI scheme, e.g. the http: part
• The usual method of interacting with a resource is by dereferencing the URI
• The rules for dereferencing are what establishes the scheme's Uniform Interface [Uniform Interface (1)]

(14) URI Schemes

URI = scheme ":" hier-part [ "?" query ] [ "#" fragment ]

http://dret.net/lectures/iot-spring15/rest#uri-schemes

• URIs in their general case are very simple
  • The scheme identifies how resources are identified
  • The identification may be hierarchical or non-hierarchical
• Many URI schemes are hierarchical
  • It is then possible to use relative URIs such as in <a href="./"/> [./]
  • The slash character is not just a character, in URIs it has semantics
• Query components specify additional information
  • It is non-hierarchical information further identifying the resource
  • In most cases, it can be regarded as input to the resource

(15) Resources & Representations

• When a URI is dereferenced by a web browser, it receives some data
  • In HTTP, that data is accompanied by metadata in the form of HTTP headers
• That data is called a representation of the resource identified by the URI
  • One implortant metadata field the the data's media type (HTTP Content-Type)
• Resources are abstract, representations are concrete
  • A document can be represented in HTML, PDF, and other representations
• Resources may have various representations, and they may vary with time

(17) DNS & HTTP

The two basic protocols which every Web browser must implement are DNS [Internet and Web Layering; Domain Name System (DNS) (1)] access and HTTP [Hypertext Transfer Protocol (HTTP) (1)]. However, most operating systems provide an API for DNS access, so the browser can use this service locally and only has to implement HTTP. TCP [Internet and Web Layering; Transmission Control Protocol (TCP) (1)] support (which is required as the foundation for HTTP) is usually provided by the operating system.

(18) HTTP Messages

• HTTP needs a reliable connection
  • The foundation for HTTP is the Transmission Control Protocol (TCP) [Internet and Web Layering; Transmission Control Protocol (TCP) (1)]
  • DNS resolution yields an IP address
  • Open TCP connection to port 80 or port specified in URI (http://rosetta.sims.berkeley.edu:8085/)
• HTTP is a text-based protocol
  • The connection is used to transmit text messages
  • All HTTP messages are human-readable (not all entities, though)
  • Basic HTTP operations can be carried out by hand (e.g., per telnet)

start-line
message-header *

message-body ?

(19) HTTP Header Fields

• Header fields contain information about the message
  • General header: Date as the message origination date
  • Request header: Accept-Language indicates language preferences
  • Response header: Server contains system information
  • Entity header: Content-Type specifies the media type of the entity
• HTTP (and others) define a number of header fields [https://github.com/dret/sedola/blob/master/MD/headers.md]
  • Unknown fields must be ignored (extensibility)
• HTTP is about acting on these fields
  • HTTP defines what HTTP implementations must or should do

(20) HTTP Requests

• After opening a connection, the client sends a request
  • The method indicates the action to be performed on the resource
  • HTTP's most interesting methods are: GET, POST, PUT, and DELETE
• The URI identifies the resource to which the request should be applied
  • Absolute URIs are required when contacting proxies
  • Absolute paths are required when contacting a server directly
  • The URI may contain query information
• The Host header field must be included in every HTTP/1.1 request

Method Request-URI HTTP/Major.Minor
[Header]*

[Entity]?

(21) HTTP GET

• Retrieval action based on the URI
  • Maybe implemented by reading a file
  • Maybe implemented by processing a file (PHP)
  • Maybe implemented by running code
• Semantics may change based on header fields
  • If-*: only reply with the entity if necessary
  • Range: only reply with the requested part of the entity
• Cacheability depends on header fields of the response

GET / HTTP/1.1
Host: ischool.berkeley.edu

(22) HTTP Responses

• The server's response to acting on a request
  • the status code is given numerically and as text
  • 2** for variations of ok
  • 3** for redirections
  • 4** are different client side problems (404: not found)
  • 5** are different server side problems
• Header fields specify additional information
  • Information about the server
  • Information about the entity (media type, encoding, language)

HTTP/Major.Minor Status-Code Text
[Header]*

[Entity]?

(23) HTTP Performance

• HTTP/1.0 allowed one transaction per connection
  • TCP connection setup and teardown are expensive
  • TCP's slow start slows down the initial phase of data transfer
  • Typical Web pages use between 10-20 resources (HTML + images + CSS + scripts)
  • Typically, these resources are stored on the same server
• HTTP/1.1 introduces persistent connections
  • The TCP connection stays open for some time (10 sec is a popular choice)
  • Additional requests to the same server use the same TCP connection
• HTTP/1.1 introduces pipelined connections
  • Instead of waiting for a response, requests can be queued
  • The server responds as fast as possible
  • The order may not be changed (there is no sequence number)

(24) HTTP Connection Handling

(25) HTTP Access Control

• HTTP servers can deny access [http://en.wikipedia.org/wiki/List_of_HTTP_status_codes#4xx_Client_Error] because of access control
  • 401 Unauthorized means the resource is access controlled
  • 403 Forbidden means the resource is inaccessible
  • 405 Method Not Allowed signals a request using the wrong request method [HTTP Requests (1)]
• Two different approaches to unauthorized access are possible
  • Repeat the HTTP request with the proper authentication credentials
  • Redirect to a authentication resource for authentication

(26) HTTP Authentication

(27) Basic HTTP Authentication

• Authentication is based on authentication realms
  • A set of resources for which the authentication is required
  • An opaque name which is used to signal which login is required
  • Username/password often is specific for a given realm
• Users supply username and password through the client
  • Sent as Base64 [http://en.wikipedia.org/wiki/Base64] encoded username:password string
  • Username and password are not transmitted securely [http://www.google.com/search?hl=en&q=base64+decoder]
  • Basic authentication should always use HTTPS
• Authorization is handled on the server side

  HTTP/1.0 401 Unauthorized
  WWW-Authenticate: Basic realm="SokEvo"

  [http://en.wikipedia.org/wiki/Basic_access_authentication]

  GET /private/index.html HTTP/1.0
  Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

  [http://en.wikipedia.org/wiki/Basic_access_authentication]

(28) Repeated Access

• Clients typically access more than one protected resource
  • A perfectly stateless client would always request authentication from the user
  • Using the realm clients can identify repeated accesses to sets of resources
• Web interactions by default are perfectly stateless
  • Each request is completely independent from other requests
  • Stateless interactions make the Web loosely coupled and scalable
  • Concepts like the realm or cookies introduce state
• Clients remember the authentication and replay it automatically
  • Browsers provide little control over this feature
  • Logging out of HTTP authenticated sessions is hard

(29) Login Page

• Basic HTTP Authentication [Basic HTTP Authentication (1)] works with browser controls (including the login window)
  • No possibility to log out without using browser-specific controls
  • Client side security depends on browser security measures
• Using forms gives more freedom in session management
  • Authentication and authorization are completely application-based

(31) Activity Streams 1.0

• Developer effort in an attempt to interconnect social networks
  • Counter-intuitive given then walled garden nature of most social networks
  • Even the social giants need proper plumbing between their services
• Simple and informative standard that was implemented but never (fully) documented
  • Some parts of the specification did not see good support in implementations
• Enterprise 2.0 customers demand stable and official standards
  • Social Enterprise Platforms are essentially integration platforms
  • Only robust and open models turn them into good IT solutions

(32) Activity Streams 2.0

• Activity Streams 1.0 [Activity Streams 1.0 (1)] were successful but not a very solid specification
• Social Networks are increasingly important for Enterprise IT
  • Enterprises slowly but increasingly understand the necessity for loose coupling
  • Enterprise Social Networking [http://en.wikipedia.org/wiki/Enterprise_social_networking] has a lot of potential
  • Deploying one centralized infrastructure repeats errors of the past
  • The alternative idea is to interconnect heterogeneous systems
• Large Enterprise IT providers have pushed for AS to become more mature
  • IBM uses AS for interconnecting products for software lifecycle management [http://en.wikipedia.org/wiki/Application_lifecycle_management]
  • SAP uses AS in their enterprise collaboration tools
  • Customers demand for those platforms to be open and extensible
• AS2 is now being standardized in the W3C [http://www.w3.org/]'s Social Web WG [http://www.w3.org/Social/WG]
  • Activity Streams 2.0 [http://www.w3.org/TR/activitystreams-core/]
  • Activity Vocabulary [http://www.w3.org/TR/activitystreams-vocabulary/]

(34) AS needs Vocabularies

• AS is about activities and needs shared understanding
  • Without a vocabulary, it is a grammar without content
  • Vocabularies allow to build meaningful sentences with shared meaning
• Basic AS statement: Erik added a picture to Flickr
  • Actor: Erik
  • Verb: add
  • Object: picture URI [https://www.flickr.com/photos/dret/15433487108/]
  • Target: Flickr stream URI [https://www.flickr.com/photos/dret/]
• AS mixes three ways in how these concepts can be represented
  • By Value: The actor's name is Erik (good for simple rendering)
  • By Registry Reference: The well-known verb is add [http://dret.github.io/W3C/SocialWG/AS1-in-AS2.html#verb-definition-add] (good for shared meaning)
  • By URI Reference: Erik's Flickr Photostream [https://www.flickr.com/photos/dret/] (good for extensibility)

(35) Use, Extend, or Define?

• AS has three levels of verb expressivity

1. Using a well-known verb in the way how it has been defined
   • Erik just added something to an existing resource.
2. Extending a well-known verb in ways that make sense for those knowing the extension
   • For those who know and care, here is additional info about the camera.
3. Defining new verbs which do not mean anything for those not knowing them
   • Erik just edited the picture he added earlier.