REST and JAX-RS

JAX-RS… and the REST will follow

Guy Nir

» REST – What ? Who ? Why ?

» JAX-RS (JSR-311) - Digg’n in

» Security

» Application-Level Protocol

» Summary

Agenda

What ? Who ? Why ?

… and how

Architectural overview

What ? Who ? Why ?

HTTP clientYahoo’s weather

web-server

HTTP request

HTTP response

GET http://weather.yahoo.com/israel/tel-aviv/ramat-gan-1967869/

RESPONSE CODE: 200 (OK) + BODY

Architectural overview

What ? Who ? Why ?

The weather in Israel at Tel-Aviv area (Ramat Gan).

HTTP request overview

What ? Who ? Why ?

GET /israel/tel-aviv/ramat-gan-1967869/ HTTP/1.1

Host: weather.yahoo.com

Accept: image/gif, application/xaml+xml, */*

Accept-Language: en-us

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; ... )

Accept-Encoding: gzip, deflate

Connection: Keep-Alive

Cookie: BA=ba=2139&ip=82.80.99.106&t=1258874241;

web-server

HTTP request

What ? Who ? Why ?

Cookie: BA=ba=2139&ip=82.80.99.106&t=1258874241;

web-server

HTTP request

What ? Who ? Why ?

Accept: image/gif, text/plain, application/xml, */*

Cookie: BA=ba=2139&ip=82.80.99.106&t=1258874241;

web-server

HTTP request

What ? Who ? Why ?

Cookie: BA=2139&ip=82.80.99.106&t=1258874241;

web-server

HTTP request

What ? Who ? Why ?

HTTP/1.1 200 OK

Connection: close

Content-Type: text/html;charset=utf-8

Cache-Control: private

Content-Length: 69947

Date: Sun, 22 Nov 2009 07:59:11 GMT

Set-Cooie: t=164531234;

web-server

HTTP request

What ? Who ? Why ?

HTTP/1.1 200 OK

Connection: close

Date: Sun, 22 Nov 2009 07:59:11 GMT

Set-Cooie: t=164531234;

web-server

HTTP request

What ? Who ? Why ?

HTTP/1.1 200 OK

Connection: close

Date: Sun, 22 Nov 2009 07:59:11 GMT

Set-Cooie: t=164531234;

web-server

HTTP request

What ? Who ? Why ?

HTTP/1.1 200 OK

Connection: close

Date: Sun, 22 Nov 2009 07:59:11 GMT

Set-Cooie: t=164531234;

web-server

HTTP request

» A resource is …

A network-accessible data object or service identified by an URI (IRI

[1] ):

• Images,

• Documents (HTML, PDF, …),

• Geo-location,

• Weather

Everything is a resource …

What ? Who ? Why ?

[1] Section 3, Atom Publishing Protocol

What ? Who ? Why ?

[1] Section 3, Atom Publishing Protocol

Resources:

» Collections

http://portal/bicycles/

» Members/Items:

http://portal/documents/mydog.doc

Method REST Operation Description

DELETE

OPTIONS

CONNECT

HTTP defines more than just ‘GET’ and ‘POST’:

What ? Who ? Why ?

Method REST Operation Description

POST CREATE (INSERT) Create or update

GET READ (QUERY) Query about the resource

PUT UPDATE (CHANGE) Update

DELETE DELETE (DELETE) I want to delete what-ever-it-is ….

HEAD I’m something like ‘GET’ [1]

OPTIONS JAX-RS mumbles something about me.

CONNECT

[1] Unique extension of JAX-RS.

» Free of any platform or language,

» Free of any schema or protocol (beyond that of HTTP),

» No ALP (Application- or Presentation- layer Protocol) coercion

» Only a set of recommendations [1]

Roy Fielding defines REST as:

What ? Who ? Why ?

[1] Principled Design of the Modern Web Architecture - Roy T. Fielding, Richard N. Taylor - section 4.

» REST recommends using URIs instead of query-based URLs:

Don’t use: http://host.com/service?type=weather&when=today

http://host.com/service/weather/today

» Atom Publishing Protocol (APP).

RFC-5023 (text-only)

Some important points …

What ? Who ? Why ?

» Architectural style, not technology !

Client/server + Request/response approach.

» Everything is a RESOURCE.

» CRUD (Create / Read / Update / Delete) …[1]

» Stateless by nature (excellent for distributed systems),

» Cacheable (naturally supported !)

» A great way to web-service !

REST is …

What ? Who ? Why ?

[1] Reference to other acronyms at Wikipedia

JAX-RS

JSR-311

» POJO-based,

» HTTP-centric,

» Format independent,

» Container independent,

» Availability as standalone and enterprise platforms.

JAX-RS goals[1]:

JAX-RS (JSR-311)

[1] JSR-311, section 1.2 - Goals

JAX-RS (JSR-311)

JAX-RSHTTP

JAX-RS (JSR-311)

This page is intentionally left blank

Gesture for times when we used to read books ….

JAX-RS (JSR-311)

http://www.disney.com/muppets/...

JAX-RS (JSR-311)

* http://www.disney.com/muppets/catalog

@Path("/catalog")

public class MuppetCatalogController {

POJO + Annotation = JAX-RS resource

Relative context

JAX-RS (JSR-311)

* http://www.disney.com/muppets/catalog

@Path("/catalog")

public class MuppetCatalogController {

public String findAllCatalogItems() {

String list = ... // Compile a list of all items.

return list;

Reading the catalog

CLIENT SERVER

GET …/catalog

List all items available for sale.

public void doGet(HttpServletRequest req,

HttpServletResponse resp) throws ... {

int muppetId;

String stringId = req.getParameter("muppetId");

if (stringId != null) {

// Hoping for no exception to occur!

muppetId = Integer.parseInt(stringId);

} else {

muppetId = ... // Use some default value …

Muppet muppet = findMuppet(muppetId);

generateTextualOutput(muppet, resp.getWriter());

JAX-RS (JSR-311)

Reading the catalog

CLIENT SERVER

GET …/catalog?muppetId=650

Properties of Kermit

@Path(“/catalog/{muppetId}”)

public String findItem(@QueryParam(“muppetId”)int muppedId) {

return ...

JAX-RS (JSR-311)

URI template

CLIENT SERVER

public String findItem(@DefaultValue(“0”)

@QueryParam(“muppetId”)int muppedId) {

return ...

JAX-RS (JSR-311)

URI template

CLIENT SERVER

public String findItem(@PathParam(“muppetId”)int muppedId) {

// ... Do something

JAX-RS (JSR-311)

URI template

CLIENT SERVER

GET …/catalog/650

@Path(“/catalog/{muppetId:[0-9]+}”)

// ... Do something

JAX-RS (JSR-311)

URI template

CLIENT SERVER

GET …/catalog/650

Regular expression

@Path(“/catalog/{muppetId:[0-9]+}”)

// ... Do something

// ACCEPT: http://.../catalog/-477

@Path(“/catalog/{muppetId:-[0-9]+}”)

public String findItem2(@PathParam(“muppetId”)int muppedId) {

// ... Do something

JAX-RS (JSR-311)

URI template

CLIENT SERVER

GET …/catalog/650

Cookies, headers and friends …

JAX-RS (JSR-311)

SERVERPublic client

Internal CRM client

http://www.disney.com

http://crm.intranet

Internet

Intranet

GET /muppet/catalog HTTP/1.1

host: crm.intranet

accept: text/plain

User-Agent: Mozilla/4.0 (...)

Cookie: user-type=ADMIN

Cookie

Cookies, headers and friends …

JAX-RS (JSR-311)

@Path("/catalog/{muppetId}/{propertyName}")

public void updateItem(

@HeaderParam("host") String hostname,

@CookieParam("user-type") UserType type, ...) {

if (!hostname.equals("crm.intranet")) { throw ... }

if (!UserType.CUSTOMER_CARE.equals(type)) { throw ... }

// ... handle the request.

enum UserType { ADMIN, CUSTOMER_CARE, TECHNICAL; }

» UriInfo

» Request

» HttpHeaders

» SecurityContext

@Context

JAX-RS (JSR-311)

public void handleRequest(

@Context UriInfo uri,

@Context SecurityContext security,

@QueryParam ("username") String username) { ... }

Content negotiation (or: cache is always money!)

JAX-RS (JSR-311)

CLIENT SERVER

GET http://..../muppets/muppetOfTheMonth/image+

Content negotiation precondition

RESPONSE:• 200 (OK) + body• 304 (Not Modified)

Content negotiation

JAX-RS (JSR-311)

@Path("/muppetOfTheMonth/image")

public Response findMuppetOfTheMonth(

@Context UriInfo uri, @Context Request request) {

File file = locateFile(uri.getRequestUri());

EntityTag tag = calculateTag(file);

Date modified = new Date(file.lastModified());

ResponseBuilder r = request.evaluatePreconditions(modified,

// ...

JAX-RS (JSR-311)

The @HEAD method

HTTP/1.1 200 OK

Content-type: text/plain

Content-length: 1024256

CLIENT SERVER

HEAD …/catalog/650/image

JAX-RS (JSR-311)

The @HEAD method@GET

@Path("/catalog/{muppetId}/image")

public Response fetchThumbnailHeadAndBody() {

return ...;

@Path("/catalog/{muppetId}/image")

public Response fetchThumbnailHeadOnly(...) {

int size = getThumbnailSize(muppetId);

ResponseBuilder builder = Response.noContent();

builder.header("Content-length", size);

builder.header(“Is-ReadOnly", true);

return builder.build();

Bridging between the two worlds ….

JAX-RS (JSR-311)

HTTP Java

MessageBodyReader

MessageBodyWriter

The Millau Viaduct bridge, part E11 highway - connecting Paris and Barcelona. The highest bridge ever

constructed.

» Provides adaptation between the “HTTP world” and our own application domain:

MessageBodyReader,

MessageBodyWriter

Providers:

JAX-RS (JSR-311)

MessageBodyWriter

MessageBodyReader

Resource class

HTTP Request

HTTP Response

Java object

JAX-RS (JSR-311)

@Path("users/{id}/properties")

public class UserPropertiesResource {

@Produces(“application/json")

public User findUser(@PathParam("id") int userId) {

return userDao.getUser(userId);

@Produces(“application/atom+xml")

public User findUser(@PathParam("id") int userId) { ... }

public void findUser(User user) {

userDao.persist(user);

JAX-RS (JSR-311)

@Provider

@Produces("application/json")

public class JSONWriter implements MessageBodyWriter<User> {

@Override

public long getSize(User user, ...) {

return JSON.toString(user).length();

@Override

public boolean isWriteable(java.lang.Class<?> type, ...) {

return User.class.equals(type);

@Override

public void writeTo(User user, ... OutputStream out) {

JSON.write(user, out);

@Path("users/{id}/properties")

public class UserPropertiesResource {

@Produces(“application/json")

public User findUser(@PathParam("id") int userId) {

// ...

public void findUser(User user) {

// ...

» Glassfish Jersey project (Sun Microsystems), https://jersey.dev.java.net/

» RESTEasy (JBoss), http://www.jboss.org/resteasy/

» Apache CXF (Apache Software Foundation), http://cxf.apache.org/

» Wink (ASF incubation project), http://incubator.apache.org/wink/

» Restlet (Noelios Technologies). http://www.restlet.org/

Leading JAX-RS implementations

JAX-RS (JSR-311)

Security

(lack of …)

» Authentication

Who’s calling ?

» Authorization

What am I allowed to do ?

» Content delivery:

Integrity,

Confidentiality,

Authentication.

Security

» Authentication

Who’s calling ?

» Authorization

Integrity,

Confidentiality,

Authentication.

Security

» Authentication

Who’s calling ?

» Authorization

Integrity,

Confidentiality,

Authentication.

Security

Application-Level Protocols

Marshalling REST data

» Proprietary (custom made) solution,

» Hessian binary web-service protocol (Caucho),

» Burlap XML-based web-service protocol (Caucho),

» Avro / Buffers protocol,

» JSON (JavaScript Object Notion),

» Protocol Buffers (by Google) ,

» Kyro (only for hard-core programmers)

Suggestions:

Content deliver

» When we have a really simple format:

Short-message strings,

Single result objects

» Specific binary format,

Multimedia (Images, Movies, etc…),

Proprietary protocol.

» Bound to certain technology:

JAXB, DOM-based (JAXP),

Java native (binary) serialization.

Proprietary (custom made) solution

Content deliver

» Binary, compact format.

» Very lightweight,

Extremely suitable to mobile or other limited devices.

Provide J2ME libraries.

» No external IDL or schema,

» Language independent,

» Support for compression, encryption, signatures (with partial external support).

Hessian binary web-service protocol

Content deliver

» Minimal XML-based format,

» Very lightweight (considering XML format),

Provide J2ME libraries.

» No external IDL or schema,

» Language independent (as XML is !),

» Suffice to operate EJB –

Cell phone -> Burlap -> RESTEasy -> EJB !

Burlap XML-based web-service protocol

Content deliver

» Part of Hadoop stack,

» Lightweight, but not as the other protocols.

» Requires schema:

Pluggable architecture to support multiple formats (JSON, XML, etc …)

» Dynamic typing (very reach with its support),

» Untagged data.

Avro serialization stack

Content deliver

» REST is a simple WS.

» JAX-RS is a reflection of the HTTP world.

Using Java-5 annotations only.

» Lack of concrete security model.

Summary

Thank you !!!

Applause now !

REST and JAX-RS

Technology

Web Service REST em JAVA com JAX-RS

Using REST and WS-* for SOA - JBoss.org Documentationdocs.jboss.org/jbossesb/presentations/RESTandWSStar.pdf · Using REST and WS-* for SOA ... –Well … JAX-RS, WCF, ... • Just

Putting Java to REST · Speaker’s Qualifications RESTEasy project lead • Fully certified JAX-RS implementation JAX-RS JSR member • Also served on EE 5 and EJB 3.0 committees

JAX-RS 2.0 with Apache CXF - events.static.linuxfound.org · Brief History of JAX-RS • Server and client HTTP services made easy • Great for REST and HTTP applications in general

RESTEasy JAX-RS · RESTEasy JAX-RS vi 34. CORS ..... 179

Entity provider selection confusion attacks in JAX-RS applications · 2016-12-13 · What is JAX-RS? •RESTful web services are based on REST architectural style •Some features

Servicios REST: Jersey JAX-RS

Web services REST avec JAX-RS · Java pour les services web RESTful (JAX-RS) dont la version courante est 2.1. Dans cet article je vais indiquer comment développer un Web service

RESTEasy JAX-RS...RESTEasy JAX-RS iv 15. @DefaultValue ..... 61

Rest Security with JAX-RS

BeJUG JAX-RS Event

Design REST Services with CXF JAX- RS implementation: best … · Design REST Services with CXF JAX-RS implementation: best practices and lessons learned Andrei Shakirin, Talend ashakirin@talend.com

Développer des Services Web REST avec Java : JAX-RS

Making Java REST with JAX-RS 2.0

Tutorial - REST con java (JAX-RS 2.0)

JAX-WS e JAX-RS

Eclipse Day India 2015 - Rest with Java (jax rs) and jersey

JAX-RS 2.1 Reloaded€¦ · #DevoxxUS JAX-RS 2.1 Reloaded Santiago Pericas-Geertsen JAX-RS Co-Spec Lead #jax-rs @spericas

Dynamically assembled REST Microservices using JAX-RS and... Microservices? - Neil Bartlett

JAX-RS.Next(): JAX-RS 2 and Beyond