5 ms·

I'll never understand why the HATEOAS meme hasn't died. Is anyone using it? Anywhere? What kind of magical client can make use of an auto-discoverable API? An

I'll never understand why the HATEOAS meme hasn't died. Is anyone using it? Anywhere? What kind of magical client can make use of an auto-discoverable API? And why does this client have no prior knowledge of the server they are talking to?

motorest 1y ago
I think OData isn't used, and that's a proper standard and a lower bar to clear. HATEOAS isn't even benefiting from a popular standard, which is both a cause and a result.
_heimdall 1y ago
You realize that anyone using a browser to view HTML is using HATEOS, right? You could probably argue whether SPAs fit the bill, but for sure any server rendered or static site is using HATEOS. The point isn't that clients must have absolutely no prior knowledge of the server, its that clients shouldn't have to have complete knowledge of the server. We've grown used to that approach because most of us have been building tightly coupled apps where the frontend knows exactly how the backend works, but that isn't the only way to build a website or web app.
- nsonha 1y ago
  HATEOAS is anything that serves the talking point now apparently
  - deleted 1y ago
    [deleted]
  - const_cast 1y ago
    For a traditional web application, HATEOS is that. HTML as the engine of application state: the application state is whatever the server returns, and we can assess the application state at any time by using our eyeballs to view the HTML. For these applications, HTML is not just a presentation layer, it is the data. The application is then auto-discoverable. We have links to new endpoints, URLs, that progress or modify the application state. Humans can navigate these, yes, but other programs, like crawlers, can as well.
  - _heimdall 1y ago
    What do you mean? Both HATEOAS and REST have clear definitions.
- dwaltrip 1y ago
  Can you be more specific? What exactly is the partial knowledge? And how is that different from non-conforming APIs?
  - _heimdall 1y ago
    Not totally sure I understand your question, sorry if I don't quite answer it here. With REST you need to know a few things like how to find and parse the initial content. I need a browser that can go from a URL to rendered HTML, for example. I don't need to know anything about what content is available beyond that though, the HTML defines what actions I can take and what other pages I can visit. RPC APIs are the opposite. I still need to know how to find and parse the response, but I need to deeply understand how those APIs are structured and what I can do. I need to know schemas for the API responses, I need to know what other APIs are available, I need to know how those APIs relate and how to handle errors, etc.
myaccountonhn 1y ago
https://htmx.org/ https://htmx.org/ might be the closest attempt?
- deleted 1y ago
  [deleted]
- rapnie 1y ago
  https://data-star.dev https://data-star.dev are taking things a bit further in terms of simplicity and performance and hypermedia concepts. Worth a look.
eadmund 1y ago
> I'll never understand why the HATEOAS meme hasn't died. > Is anyone using it? Anywhere? As I recall ACME (the protocol used by Let’s Encrypt) is a HATEOAS protocol. If so (a cursory glance at RFC 8555 indicates that it may be), then it’s used by almost everyone who serves HTTPS. Arguably HTTP, when used as it was intended, is itself a HATEOAS protocol. > What kind of magical client can make use of an auto-discoverable API? And why does this client have no prior knowledge of the server they are talking to? LLMs seem to do well at this. And remember that ‘auto-discovery’ means different things. A link typed next enables auto-discovery of the next resource (whatever that means); it assumes some pre-existing knowledge in the client of what ‘next’ actually means.
- marcosdumay 1y ago
  > As I recall ACME (the protocol used by Let’s Encrypt) is a HATEOAS protocol. On this case specifically, everybody's lives are worse because of that.
  - mardifoufs 1y ago
    I'm not super familiar with acme, but why is that? I usually dislike the HATEOS approach but I've never really seen it used seriously, so I'm curious!
recursivedoubts 1y ago
Yes. You used it to enter this comment. I am using it to enter this reply. The magical client that can make use of an auto-discoverable API is called a "web browser", which you are using right this moment, as we speak.
- physicles 1y ago
  This is true, but isn’t this quite far away from the normal understanding of API, which is an interface consumed by a program? Isn’t this the P in Application Programming Interface? If it’s a human at the helm, it’s called a User Interface.
  - recursivedoubts 1y ago
    I agree that's a common understanding of things, but I don't think that it's 100% accurate. I think that a web browser is a client program, consuming a RESTful application programming interface in the manner that RESTful APIs are designed to be consumed, and presenting the result to a human to choose actions. I think if you restrict the notion of client to "automated programs that do not have a human driving them" then REST becomes much less useful: https://htmx.org/essays/hypermedia-clients/ https://htmx.org/essays/hypermedia-clients/ https://intercoolerjs.org/2016/05/08/hatoeas-is-for-humans.html https://intercoolerjs.org/2016/05/08/hatoeas-is-for-humans.h... AI may change this at some point.
    - nlawalker 1y ago
      If you allow the notion of client to include "web browser driven by humans", then what is it about Fielding's dissertation that is considered so important and original in the first place? Sure it's formal and creates some new and precise terminology, but the concept of browsing was already well established when he wrote it.
      - recursivedoubts 1y ago
        It formalized the network architecture of distributed hypermedia systems and described interesting characteristics and tradeoffs of that approach. Whether or not it did a GOOD job of that for the layman I will leave to you, only noting the confusion around the topic found, ironically, across the internet.
kelseyfrog 1y ago
I used it on an enterprise-grade video surveillance system. It was great - basically solved the versioning and permissions problem at the API level. We leveraged other RFCs where applicable. The biggest issue was that people wanted to subvert the model to "make things easier" in ways that actually made things harder. The second biggest issue is that JSON is not, out of the box, a hypertext format. This makes application/json not suitable for HATEOAS, and forcing some hypertext semantics onto it always felt like a kludge.
deleted 1y ago
[deleted]

motorest 1y ago

I think OData isn't used, and that's a proper standard and a lower bar to clear. HATEOAS isn't even benefiting from a popular standard, which is both a cause and a result.

_heimdall 1y ago

You realize that anyone using a browser to view HTML is using HATEOS, right? You could probably argue whether SPAs fit the bill, but for sure any server rendered or static site is using HATEOS. The point isn't that clients must have absolutely no prior knowledge of the server, its that clients shouldn't have to have complete knowledge of the server. We've grown used to that approach because most of us have been building tightly coupled apps where the frontend knows exactly how the backend works, but that isn't the only way to build a website or web app.

nsonha 1y ago
HATEOAS is anything that serves the talking point now apparently
- deleted 1y ago
  [deleted]
- const_cast 1y ago
  For a traditional web application, HATEOS is that. HTML as the engine of application state: the application state is whatever the server returns, and we can assess the application state at any time by using our eyeballs to view the HTML. For these applications, HTML is not just a presentation layer, it is the data. The application is then auto-discoverable. We have links to new endpoints, URLs, that progress or modify the application state. Humans can navigate these, yes, but other programs, like crawlers, can as well.
- _heimdall 1y ago
  What do you mean? Both HATEOAS and REST have clear definitions.
dwaltrip 1y ago
Can you be more specific? What exactly is the partial knowledge? And how is that different from non-conforming APIs?
- _heimdall 1y ago
  Not totally sure I understand your question, sorry if I don't quite answer it here. With REST you need to know a few things like how to find and parse the initial content. I need a browser that can go from a URL to rendered HTML, for example. I don't need to know anything about what content is available beyond that though, the HTML defines what actions I can take and what other pages I can visit. RPC APIs are the opposite. I still need to know how to find and parse the response, but I need to deeply understand how those APIs are structured and what I can do. I need to know schemas for the API responses, I need to know what other APIs are available, I need to know how those APIs relate and how to handle errors, etc.

myaccountonhn 1y ago

https://htmx.org/ https://htmx.org/ might be the closest attempt?

deleted 1y ago
[deleted]
rapnie 1y ago
https://data-star.dev https://data-star.dev are taking things a bit further in terms of simplicity and performance and hypermedia concepts. Worth a look.

eadmund 1y ago

> I'll never understand why the HATEOAS meme hasn't died. > Is anyone using it? Anywhere? As I recall ACME (the protocol used by Let’s Encrypt) is a HATEOAS protocol. If so (a cursory glance at RFC 8555 indicates that it may be), then it’s used by almost everyone who serves HTTPS. Arguably HTTP, when used as it was intended, is itself a HATEOAS protocol. > What kind of magical client can make use of an auto-discoverable API? And why does this client have no prior knowledge of the server they are talking to? LLMs seem to do well at this. And remember that ‘auto-discovery’ means different things. A link typed next enables auto-discovery of the next resource (whatever that means); it assumes some pre-existing knowledge in the client of what ‘next’ actually means.

marcosdumay 1y ago
> As I recall ACME (the protocol used by Let’s Encrypt) is a HATEOAS protocol. On this case specifically, everybody's lives are worse because of that.
- mardifoufs 1y ago
  I'm not super familiar with acme, but why is that? I usually dislike the HATEOS approach but I've never really seen it used seriously, so I'm curious!

recursivedoubts 1y ago

Yes. You used it to enter this comment. I am using it to enter this reply. The magical client that can make use of an auto-discoverable API is called a "web browser", which you are using right this moment, as we speak.

physicles 1y ago
This is true, but isn’t this quite far away from the normal understanding of API, which is an interface consumed by a program? Isn’t this the P in Application Programming Interface? If it’s a human at the helm, it’s called a User Interface.
- recursivedoubts 1y ago
  I agree that's a common understanding of things, but I don't think that it's 100% accurate. I think that a web browser is a client program, consuming a RESTful application programming interface in the manner that RESTful APIs are designed to be consumed, and presenting the result to a human to choose actions. I think if you restrict the notion of client to "automated programs that do not have a human driving them" then REST becomes much less useful: https://htmx.org/essays/hypermedia-clients/ https://htmx.org/essays/hypermedia-clients/ https://intercoolerjs.org/2016/05/08/hatoeas-is-for-humans.html https://intercoolerjs.org/2016/05/08/hatoeas-is-for-humans.h... AI may change this at some point.
  - nlawalker 1y ago
    If you allow the notion of client to include "web browser driven by humans", then what is it about Fielding's dissertation that is considered so important and original in the first place? Sure it's formal and creates some new and precise terminology, but the concept of browsing was already well established when he wrote it.
    - recursivedoubts 1y ago
      It formalized the network architecture of distributed hypermedia systems and described interesting characteristics and tradeoffs of that approach. Whether or not it did a GOOD job of that for the layman I will leave to you, only noting the confusion around the topic found, ironically, across the internet.

kelseyfrog 1y ago

I used it on an enterprise-grade video surveillance system. It was great - basically solved the versioning and permissions problem at the API level. We leveraged other RFCs where applicable. The biggest issue was that people wanted to subvert the model to "make things easier" in ways that actually made things harder. The second biggest issue is that JSON is not, out of the box, a hypertext format. This makes application/json not suitable for HATEOAS, and forcing some hypertext semantics onto it always felt like a kludge.

deleted 1y ago

[deleted]