my blog. for you.

Let’s talk digital.

I’m an independent IT consultant and entrepreneur in the Internet and software business. I’m interested in design, enterprise applications, web apps and SaaS products. I design and develop business solutions and applications. I help companies in terms of software quality and knowledge transfer, e.g. with Angular and Spring Boot.

Automating Processes: Meeting Notes

One of the key benefits of business software, or as a matter of fact, any software, is automation of tedious, repetitive tasks. One of the three great virtues of a programmer according to Perl creator Larry Wall is laziness as defined in: "The quality that makes you go to great effort to reduce overall energy expenditure. It makes you write labor-saving programs that other people will find useful and document what you wrote so you don't have to answer so many ... Read more

CORS: What It Is and How It Works

Expanding on last week's article on best practices for REST API Design I'd like to point to a specific aspect working REST APIs frequently entails: A browser security feature called "Cross-Origin Resource Sharing (CORS)". This feature allows you to define which resources provided by a web application are supposed to be accessible from which origin, which in turn typically is comprised of protocol, host / domain name and port. This website's origin for example is https://bjoernkw.com:80 (port 80 is the default port ... Read more

REST API Design: Best Practices

It's probably safe to say that REST (REpresentational State Transfer - originally described by Roy Fielding) is the most widely used architectural pattern when it comes to APIs in web application contexts. From statelessness, to self-descriptive messages, and hypermedia as the engine of application state (HATEOAS) REST comes with quite a few principles, constraints, patterns, and flavours, not all of which are used or applied consistently with each REST API. REST often is a rather loosely-applied architectural pattern or a continuum, on ... Read more

API-First Development with Spring Boot and Swagger at Reflectoring

When I recently had to look into some of the specifics of using Swagger and OpenAPI for designing an API specification and generating a Spring Boot application skeleton from that specification (using OpenAPI Generator) I came across this very useful and comprehensive article on the subject on the Reflectoring blog: API-First Development with Spring Boot and Swagger From creating an API specification with the Swagger editor to generating code (with the OpenAPI Generator Maven plugin, specifically) and implementing the generated interfaces the article ... Read more

The Richardson Maturity Model for REST APIs

On his website about software design patterns Martin Fowler provides an in-depth explanation of the Richardson Maturity Model for HTTP-based REST APIs by Leonard Richardson. According to that model REST APIs come in 4 levels of sophistication: Level 0, aka the "Everything is a POST request" model for example propagated by SOAP. This is basically tantamount to remote procedure invocation. Level 1 - Resources: Every resource is accessed through its own canonical URL. Level 2 - HTTP Verbs: Verbs such as GET, PUT, PATCH and ... Read more

API Security Best Practices by Expedited Security

For everyone dealing with web-based APIs, both as a provider and a consumer, web app security service supplier Expedited Security (known for Expedited SSL, among other products) has compiled a vast, extensive compendium on API security best practices. The importance of secure APIs and best practices that help has make APIs more secure and dependable can't be emphasised enough. Covering each possible attack vector and adopting every best practice out there can seem like a truly daunting task. Guides like this one help ... Read more

Jess Frazelle: “For the Love of Pipes”

Somewhat recently, Jess Frazelle wrote about her love of UNIX pipes, a sentiment I wholeheartedly share, to the extent that I think web apps should behave more like Unix programs by making data readily available via APIs so other applications can easily process that data. This, in a nutshell, is the Unix philosophy as stated by Doug McIlroy: Make each program do one thing well. To do a new job, build afresh rather than complicate old programs by adding new "features". Expect the output ... Read more

HTTP and REST Standards, Protocols and Headers for More Secure and More Robust Applications

Standards.REST is a website that helps you create better, more robust HTTP- and REST-based applications by providing an overview of existing, proven standards that allow you to build on existing solutions rather than re-invent the wheel yourself. The list of standards mentioned includes OAuth 2.0, the HTTP Caching standard and Application-Level Profile Semantics (ALPS), which - among others - is used extensively in Spring Data REST and Spring HATEOAS. On a closely related note, Stefan Judis published an article on HTTP headers ... Read more

HTML is an API

HTML is an API or rather it could be if we used more in the way it was intended. In a comment on this Hacker News post about Toapi, a library that makes clever use of XPath expressions in order to provide an API from existing web pages, a user wrote Now I don't want to be a downer: but we collectively seem to have forgotten that HTML as a markup language with sufficient semantic elements, is a perfect API in itself. ... Read more
Next Page »