As you probably know, I’m involved in the OIOREST work for NITA. The work is progressing slowly, but recently I’ve had some thoughts on REST which I thought were sharable.
I’ve been on quite a number of projects where one service had to call another service in order to return a complete result. This gives long chains of service calls, and lead to highly coupled systems which are not very fault tolerant. With REST, it’s suddenly much easier to just return a document with references to other documents, and if it’s necessary, the client can fetch the other documents, and in the process utilize HTTP caching and other well-known mechanisms. This way, a client can fetch a root document, and immediately show the page and then fetch the rest of the data – what Martin Fowler calls Segmentation By Freshness.
Unfortunately, I’ve not seen any “enterprise systems” use REST like this, but I can’t see why it should not be possible, and even better than the WS-approach.
The second point about REST is about privacy. This is a hot topic in Denmark at the moment – a new national digital signature is on the way, and we’re helping NITA implement Single Signon using SAML 2.0. SSO makes it easier to acccess protected resources, but it also makes it harder to maintain privacy as a citizen. Most people look at SSO and the government pragmatically and trust that the government will do no harm. I guess I belong to that group to some degree, but other people, like Stephan Engberg maintains that the government should not be trusted, and that data should forever be owned by the person behind it, and nobody but the person should be able to combine it with data from other systems. Typically, this is accomplished by using pseudonyms – the person essentially gets a new identity for each system, and nobody knows all the identities (unless the person revals some or all of them).
I quit agree with this, I just can’t see how it can be implemented just now. However, REST looks like a good technology to use here. REST is relevant because, as mentioned above, it moves the responsibility for combining data from a closed system to an open client. With REST, a client can retrieve data from different sources, using different identities, and combine it locally, and the person behind the computer will be the only one to ever know. The same principles apply when
Of course there are details like XSS, trusting the client code not to do something wrong, and so on, but again: it’s all based on an open platform, and if you’re worried, you can make your own client.
I doubt anything like this will happen anytime soon – the tax office probably won’t like not being able to combine data automatically to prevent fraud, so we’ll probably just work on REST services which are not people related for now.
Today, we had the OIOREST workshop, a workshop on the OIOREST initiative, we’re a part of at Trifork. The workshop was meant to inform about REST in the Danish public sector and to hear what users and developers had to say. The workshop went pretty well – not a lot was changed, but at least we were (more or less) confirmed in our view that REST does have its place.
The workshop was centered around a couple of Open Space sessions. One of the topics discussed was “REST vs WS-*”. While working with OIOREST, this topic has come up again and again: What is REST in relation to SOAP and WS-*, and when should each be used? This has been the basis for many heated discussions, and today was not much different. Most people say something like “REST is for simple things, but when things get too complicated, you’ll want to use WS-*”. I can’t really figure out what to think about this. First of all, what is simple and what is complicated? Complicated scenarios often include transactions and reliability. Distributed transactions are evil, period. Reliability is handled in REST by adhering to the HTTP verbs and keeping operations idempotent, so that’s not really a good argument either. Another argument against REST is “now we’ve finally developed all these standards for SOAP, why should we then do the same for REST?”. Ignoring that REST is older than SOAP and WS-*, somehow this argument also feels wrong.
I agree that REST is not for everything: if you want a RPC interface, don’t use REST. If you work in an organization which is committed to SOAP-based web services, don’t use REST (at least not openly). If you have the need for hierarchical data in the message header, REST doesn’t quite fit. If you want to use only GET/PUT/DELETE/POST, it will for example, be hard to implement transfers between two accounts in REST.
Now, everything is possible, and all of this can be modeled in REST, but it’s starting to look wrong and diverge from “real” REST. Something like WS-Security seems hard to implement in a nice way in REST. WS-Security makes it possible to sign and/or encrypt XML payloads transparently. The signature is placed in the SOAP header, and the payload format does not have to support digital signatures directly. If you need end-to-end security, this is a pretty nice thing, and REST does not have something similar. Some payload formats, for example Atom Publishing Protocol, supports signatures as a part of the payload itself. WS-Security still has the advantage that no matter what format you’re using, you can use the same mechanism for signing and checking signatures.
WS-Security has some potential, but I’ve also seen a lot of cases where WS-Security could be replaced by plain SSL instead together with a simple Authorization header. So, the original question is still valid: what are the scenarios where SOAP/WS-* simply cannot be avoided? My guess is that there is no good answer for this, just as there is no good answer to the question “when should we use Ruby instead of Java?”, or “when should we use PostgreSQL instead of MySQL?”. The answers to these questions will depend on who you are, what your experience is, where you’re working, and so on. The only way is probably to try some different scenarios in REST and SOAP and see what approach is most successful – which is what we’re in the process of doing with the Danish Nature and Environment Portal, but more about that another day.