2 ms·
JSON RPC tends to embed credentials into the body, where REST puts them in the URL string or headers. This gives you the advantage of load balancers being able
by mike_d 4y ago
JSON RPC tends to embed credentials into the body, where REST puts them in the URL string or headers.
This gives you the advantage of load balancers being able to fast drop misbehaving clients for load shedding. You also have the security advantage of authenticating a legitimate client before handing off the payload to a parser (both as a DoS vector, or the risk of parsing untrusted data).
- RedShift1 4y ago> JSON RPC tends to embed credentials into the body, where REST puts them in the URL string or headers. The JSON RPC spec says nothing about authentication, you can use whatever authentication method you wish.
- silvestrov 4y agoMany people have learned the hard way that it is one thing what the spec says, another what software actually do. This is a variation of Hyrum's Law: With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody. https://www.hyrumslaw.com https://www.hyrumslaw.com
- nsteel 4y ago> JSON RPC tends to embed credentials into the body Really? For a JSON-RPC over HTTP API? Where? If you are using a generic JSON-RPC framework (does that exist?) which supports multiple transports then credentials in the request object seems like a good optional feature but surely you could disable it and stick your regular HTTP auth middleware in front?