Search code examples
urlresturiopenrasta

OpenRasta URI and method binding clarification - RESTful webservice

I'm using Openrasta for my RESTful webservice and I've a small doubt with regards to the method parameters and URI

For example: I've following Setup for user entity.

Configuration:

 ResourceSpace.Has.ResourcesOfType<User>()
          .AtUri("/user")
          .And.AtUri("/user/{userId}")
          .HandledBy<UserHandler>()
          .AsJsonDataContract()
          .And.AsXmlDataContract();

Handler method for PUT:

public OperationResult Put(long userId, User user){}

URI for the same will be http://localhost/User/1

Request body will contain a JSON as below:

{
  "userId":1,
  "userName":"FirstName"
}

Here, my question is: Defining the PUT method with two parameters is correct or not? If it is right way to do that, then userId parameter in the PUT method will contain same value as User entity property UserId.

And, in the PUT method I need to verify whether these two values are same or not and if they are not same I return BadRequest stating that URI doesn't match with the entity provided in request. Why should we do this explicitly why not it can be handled while processing the request and have PUT method take only User entity as parameter? Am I missing anything drastically or is my understanding about this design completely wrong? Any thoughts or opinions please?

Solution

  • There's a few reasons for it.

    First, it's a technical limitation of how URI parameters are processed and matched to inputs one variable at a time. The same gets applied to key/values codecs, so that ought to let you have one User object. but when you use a json codec, we get back a full object, so that would end up overriding User alltogether.

    The second one is that I never tried to fix that problem, mostly because combining uri parameters and response bodies leads to a whole bunch of hidden security issues you probably want to stay well clear of.

    Last and not least, from a modeling perspective a ReST API ought to use URIs as identifiers and links instead of foreign keys, so if you already have your identifier (the URI), there's little reason why that should be modeled in your entity body.