Source
dev10•

I see that in the tutorial, the update (PUT) and create (POST) action make use of parameters specified in the URL. This is a bad practice as they should be posted in the body of the request.

If you set up the API in that way, you should create a User type to handle the posted data. This also makes it a lot easier to add validation the create and update methods.

An example of this can be found here: http://williamdurand.fr/2012/08/02/rest-apis-with-symfony2-the-right-way/

5
phpoptimist•

Thanks for feedback but to show the records posted and updated in a tutorial id is needed to be revealed. the parameter data is caught in request variables and then doctrine take cares of all. great advice i'll read that.

0
ThePsion5•

I believe u/dev10 is referring to including query parameters to specify the data being inserted or updated, not the identifiers. For example:

/rest/post/?name=foo&role=bar

In this case, both, name and role should be specified as part of the request body.

3
10xdeveloper•

This looks like it was written from a beginner. It doesn't even come close to being REST. Pretty much everything is wrong from urls, over response data, to the returned status codes. There is literally no error handling. Everything but listing all users will produce an unhandled exception when an invalid id is passed as argument. This in itself is bad enough, but being hosted on a blog from a managed cloud hosting provider is outright scary to me. If the rest of their work is half as sloppy it's a disaster waiting to happen.

5
phpoptimist•

@10xdeveloper This tutorial is written for beginners as stated in the title "Simple Rest Api". It would be great if you define more how the URL'S are wrong?. In the kick start tutorials the focus is manipulation of records you can see many tutorials on internet regarding this. But yes the second part of this tutorial has an extensive approach to error handling. When it comes to Production environment the approach is different for coding.

0
ThePsion5•

The URLs have no reference to the relevant entities, and they have the action verb directly in the URL. Both of these are bad practices. For example, /rest/post/ should be /users/, and /rest/update/2 should be /users/2. The actions for each URL are described by the HTTP verb used, not any URL segment.

6
phpoptimist•

Thanks for the correction URL's are updated. Actually the main concern was to show how you can make simple REST in symfony that's why data was the main concern. But if you exactly use /user/ route in URL anybody finds this is user route that's why to hide this Different route names was used.

1
ItsKiwifruit•

You shouldn't have any information disclosure by outsiders knowing the route for users. Hiding your routes behind confusing names is pointless. Remember, security through obscurity is not security at all.

1