During my time as CakePHP programmer I was faced to the problem of writing a REST web service, which was not such a piece of cake after all. In fact, it required so much research that I begun to write a series of posts about how to write RESTful web services with CakePHP (series that I never finished because I stopped using that framework).
In this article I want to talk about the problems I found and offer a possible solution, because when something that should be natural and easy becomes tricky and the subject of many how-to articles it means that something is not right.
First of all: What are the problems that cause of the gap between most currently available PHP frameworks philosophy and REST?. In my opinion they are: the action oriented mind, the URL problem and the session problem. At the end I will offer one possible solution to this problem and an existing implementation.
Action oriented mind
We, programmers, are used to think in terms of actions: find, add, update, delete, calculate tax, show price, etc. This seems logical because that is how we do it in structured and object oriented programming. So lets say that we need to show some product’s information: we will write a function called view() that receives the product’s ID as parameter an displays its information. Now lets say that we want to solve this problem using some MVC PHP framework, we would do something like this:
class ProductsController {
function view($id)
{
$theProduct = findPorduct($id);
renderView("product", $theProduct);
}
}
Then we would write the following URL in our browser:
http://www.domain.com/products/view/321.
Anyone with some experience with at least one PHP framework will recognize all this (beyond simplifications) as more or less the way of doing it. I will be back to this example later, for now let me just say that this is OK, but it is not REST.
The URL problem
When I was writing the article about how to write RESTful web services with CakePHP I fell on many authors that claimed that REST was all about pretty URLs. For example, for these authors the following URL was REST:
http://www.domain.com/products/view/321
while this one was not:
http://www.domain.com/products.php?id=321.
The fact is however that it is all the way around.
I don’t want to get into the details of REST architecture here, all I will say is that a well formed RESTful URL must be a noun and not a verb; meaning that it must point to a resource and say nothing about the action performed on that resource; and once again: pretty URL have nothing to do this.
The Session problem
The other big issue we find when we analyze RESTful capabilities of major PHP frameworks is its full support for sessions. Sessions are also something that every Web programmer has gotten used to because it easily solves the problem of state persistence; but this way of designing Web sites does not play along with HTTP’s stateless architecture.
In many situations we need to have some sort of state persistence to keep track of users progress from one request to the other; the real issue here is that sessions solve this by keeping state information on the server and that is in fact what goes against REST. Such state persistence must be accomplished by using cookies instead. A well known example of a system using cookies instead of sessions for state persistence is WordPress.
So there, those are the major problems that make such a difficult task writing RESTful web services with most popular PHP frameworks. True it is that they offer mechanisms to create URL mapping which would allow for using well formed RESTful URLs, but at the end, all it does is to internally map a well formed RESTful URL into a non RESTful one. This could be seen as a good solution, but the fact is that it still ignores one fundamental aspect of REST architecture: HTTP actions.
As we know, every HTTP request includes an action among which the most well known are: GET and POST. But there are several others such as PUT, DELETE, and five more. These methods or verbs or actions are always sent in the request headers. So in the example above by sending the view verb in the URL we were in fact being redundant, because when we hit return in our browser the method GET was already being sent. Putting all this together we can see now that the URL http://www.domain.com/products.php?id=321 along with the HTTP method GET is all the server needs to understand what it should do, there is no need for a verb in the URL.
A possible solution
We have already seen three major problems that prevent us from using popular PHP frameworks to easily and naturally write RESTful web services. We have also stated that HTTP protocol methods plus noun oriented URLs are enough to properly process any HTTP request. What we have not yet discussed is if the problem we have is worth the cost of finding a solution; of course the answer to me is a bold yes, because once we have the tool (a framework that natively produces RESTful applications) and we get use to think in terms of HTTP verbs and noun oriented URLs, we have a whole new range of possibilities.
More secure Web applications
Since we don’t use sessions anymore we get rid of all its associated security problems. Sessions may still be necessary for some applications such as a shopping cart to remember cart content, but this could be done without caring about keeping that information safe since it is not critical.
Native RESTful applications
Writing a RESTful web service would not be a problem anymore because the whole application would be a web service itself, capable of detecting what must be done on which resource and how information should be returned.
Plus, since we got rid of sessions we can be sure that an application may respond to requests coming from the same application as well as from those coming from external applications, provided the required cookies are sent along. This leads to the next important feature:
Full integrability
An application that usually have a mechanism to display a list of products could, with minimum changes, start to share that same information with external applications. This is so, again, because even the simple request that returns HTML code to a browser is a RESTful web service that may be easily extended to return the same information formatted as jSon or XML or even as a serialized PHP array.
I have had the chance to prove myself right in at least the last two points -because I have not yet been victim of hackers but this may just be a matter of time… no rush though-. Anyway, the point is that there is already a RESTful PHP framework under construction but fully functional and already being used successfully to build real applications. I am talking about the a3gFramework project.