Distributed Systems And Design NodeJS - Chapter 2: Protocols

HTTP Semantics

• HTTP methods: This value is the first word in the request line. In Example 2-2, the method is POST. There are several HTTP methods, and the other popular ones include (CRUD) GET, PATCH, and DELETE.

• Idempotency: An operation can be executed multiple times without risk of side effects. The HTTP methods GET, PATCH, and DELETE are each considered idempotent operations. If the result of an operation using one of those methods is unknown, for example, a network failure prevents the response from being received, then it is considered safe for a client to retry the same request.

• Status Codes: Another important concept is that of status codes, and in particular, status code ranges. A status code is the three digit number present in the response line.

• HTTP response caching: involves storing responses, typically from GET requests, to improve performance. Responses with error codes are generally not cached. The Expires header indicates how long a response should be cached.

• Statelessness: HTTP is inherently a stateless protocol. This means that by sending one message, the meaning of a future message won’t change.

(42-44)

HTTP Compression

• It is possible to compress the HTTP response body in order to reduce the amount of data sent over the network.

• The server, upon encountering the header, can then choose to compress the response body using whichever compression algorithm was supplied in the request.

• Compression is a trade-off between network payload size and CPU usage. Typically, it’s in your best interest to support HTTP compression at some point between the Node.js server and whatever client is consuming the data, especially if this is traffic being consumed by a third party over the internet.

(44-47)

HTTPS/TLS

• Transport Layer Security (TLS) is the protocol used for encrypting HTTP traffic. It’s what puts the S (secure) in HTTPS.

• TLS does encapsulate the HTTP headers as well. Much like gzip.

• TLS is a CPU-intensive operation and should also be performed by an external process such as a Reverse Proxy.

• TLS supplants the obsolete Secure Sockets Layer (SSL) protocol.

(47-)

How TLS works?

TLS works by using certificates. There are two types of certificates:

• one containing a public key, which can safely be given to anyone in the world,

• one containing a private key, which should remain a secret.

With HTTP, this means a server will provide its public key, and a client will encrypt requests using the public key. When the client first communicates with the server, it also generates a large random number, essentially a password for the session, which is encrypted with the public key and sent to the server. This temporary password is used to encrypt the TLS session.

(47-53 - You must do the examples in this chapter)

JSON over HTTP

• HTTP standard doesn't strictly define what goes in the body.

• Many modern APIs use JSON over HTTP, often mistakenly referred to as REST. This approach has limitations, such as inconsistent error representation and handling of meta information like pagination.

• Different services implement JSON over HTTP differently, leading to the need for new code for each service.

• To address these issues, standards like JSON:API, JSON Schema, and OpenAPI (Swagger) have been developed. These standards aim to bring order to the chaos by providing guidelines for representing request and response bodies in HTTP.

The Dangers of serializing POJOs (Marshalling)

• Serialization Risks: Using JSON.stringify(obj) can expose internal properties and secrets, leading to API breaking changes.

• Marshalling: Marshalling is the process of transforming an object into a format suitable for storage or transmission, such as converting an object to JSON. It allows you to control how objects are serialized and deserialized, ensuring that only the necessary properties are included in the output.

• Implementation: Typically involves defining a toJSON() method in your classes or using libraries like class-transformer to specify how objects should be serialized.

• Leaking Information: Adding a password to a POJO leaks it in the response, while a class with toJSON() does not.

• Conclusion: Use explicit marshalling to prevent leaking sensitive information and ensure consistent API responses.

(Marshalling, Interceptors & DTOs aim both to control how data is represented and transferred between the client and server and the application layers.)

What is GraphQL & API Facade services

• GraphQL is a protocol for querying APIs, designed by Facebook. It’s very useful for building facade services, which is one service that sits in front of multiple other services and data sources.

• GraphQL attempts to solve several issues present with traditional ad hoc implementations of JSON over HTTP APIs.

• GraphQL is particularly good at returning the smallest amount of data needed by a client.

• It’s also good at hydrating a response payload with data from multiple sources so that a client can get everything it needs while making a single request.

RPC with gRPC

• Remote Procedure Call (RPC) is a pattern that allows developers to directly expose application methods (like create_invoice()) to a network, bypassing the need to create a separate interface.

• Unlike HTTP, which uses a limited set of verbs (e.g., GET, POST), RPC supports custom verbs.

• However, exposed methods must strictly manage the data they handle and the sources they accept it from, ensuring security and proper functionality.

• Popular standards for providing networked RPC endpoints between services is Google’s gRPC.

• gRPC is typically served over HTTP/2. Unlike GraphQL, which uses a single HTTP endpoint, gRPC uses the endpoint to determine what method to call.

(66-74 review RPC in depth)

Delivering gRPC over protocol Buffers

Unlike JSON over HTTP and GraphQL, gRPC typically doesn’t deliver messages over plain text. Instead, it transfers the data using Protocol Buffers (aka Protobufs), a binary format for representing serialized objects.

Such a representation leads to smaller message payloads and increased network performance.

Not only does it create more compact messages, but it also reduces the amount of redundant information sent with each message.

Regarding the OSI model, Protobufs can be thought of as running on Layer 8, while HTTP/2 runs on Layer 7.

(67-)

Field Order in Protocol Buffers (Protobufs)

Protocol Buffers, numeric values are assigned to each field, determining the order in which fields appear within a message.

This contrasts with JSON, where property order is not significant. The order in Protocol Buffers is crucial for efficient serialization and deserialization, ensuring proper handling of the data.

(69-)