Jean-Jacques Dubray just triggered a thought with a comment he made on Twitter regarding the rough ideas to adopt MVC 'ideas' in JAX-RS 2.0. He was worried that an MVC based approach to creating representations exposes the model to the service consumer.
Interestingly, this is only possible if the service uses generic media types. Specific media types sufficiently limit the kind of information that can be expressed in the representations and prevent the service specific model to be visible to the outside.
Specific media types enforce the resource boundary and prevent the service's domain model from leaking.
This is probably a much better argument against application/xml or application/json than the usual reference to the violation of message self descriptiveness.
"Specific media types enforce the resource boundary and prevent the service's domain model from leaking."
ReplyDeleteI see your POV, but think the reasoning is a bit conflated. Actually, the media-type *itself* does not prevent leakage. For example, I could craft a custom media type that exposes (leaks) various component private objects|variables, etc. Also, I could use application/xml as my content-type in responses and never leak component elements from my internal domain/data model.
I think the most common method of leaking private storage|object models over HTTP is the *framework* practice of simply converting private component objects into XML|JSON *directly*
It may be true to using a custom media type sets up a human behavior that reduces the chance of leaking component details, but there is no guarantee for this.
I mean this in the sense that a media type when done right is global and never service specific. Hence it prevents service specific models from leaking. For example, you cannot expose an AuthorAddress notion through Atom Feeds or Entries because they do not provide a means for it. (Lets not talk about extensions here)
ReplyDeleteYes! This is the difference between REST and "Option 3" http://bit.ly/czp9Kh
ReplyDeleteIt is what I was trying to get at here: http://linkednotbound.net/2010/07/19/self-descriptive-hypermedia/
What about application/rdf? Please exclude application/rdf+X here for the moment, because the X part is serialization specific and should not treat the knowledge representation structure. RDF Model provides a good basis for designing domain specific models. Although, I guess the available Semantic Web ontologies of today don't include the process model descriptions that are needed. However, I can imagine that the might be included (/possible) in the near future.
ReplyDeleteWhy would it matter if you have generic or specific media types? It seems that proper security authentication is not being used if there is any 'leakage'
ReplyDelete
ReplyDeleteI want to share a testimony on how Mr Pedro loan offer helped my life,
It isn't a good idea to use a payday loan on a regular basis. In the event that you endlessly prolong your repayment date and borrow often towards your subsequent paycheck, it could run you a good amount of money. However, it is just as sensible to decide on payday loans as they can be swiftly approved exactly the same day you put in your loan application form. You can contact Mr Pedro loan offer because my payday loan was very fast to proceed, email pedroloanss@gmail.com to request any kind of loan. Whatsapp +18632310632