4 ms·

I spent last 3 months building AngularJS + Flask where the client talks to server only through REST. There were 3 options: 1. Bare Flask 2. Flask RESTful 3.

by lukasm 13y ago

I spent last 3 months building AngularJS + Flask where the client talks to server only through REST. There were 3 options: 1. Bare Flask 2. Flask RESTful 3. Flask Restless I've spent quite some time investigating 2nd and 3rd options. Problems with 2nd: a) Didn't bring much to the table comparing to pure Flask. Extra abstraction and complexity that without much improvements b) Swallowing Flask exceptions c) Risk that the project will be abandoned and poor maintenance (commit frequency) 3rd: Direct mapping to SQL-Alchemy models is too restrict. Hard to change stuff - very opinionated I end up with pure Flask. It's already good with enough rest framework!. Great balance between power and abstraction. I'm looking forward to dig into this project. Would be great if it has great integration with flask admin and security. Also support for OAuth flows would be awesome. I have a few question for the author - of top of my head. How do you handle pagination? one example returns json array, what about JSON vulnerability?

emillon 13y ago
> I spent last 3 months building AngularJS + Flask where the client talks to server only through REST. I've been wanting to do something like this for a certain time, so I have a few questions if you don't mind. How do you handle authentication? Tokens? Cookies? Is there a special "API key" for your web app?
- lukasm 13y ago
  Long story short - I went full hipster on that grunt + yeoman + bower + angular ui and my conclusion is http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c.jpg http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c... Too much complexity added to project. Going REST patch is problematic when you have to integrate with server-render style lib or service. SEO is shit. Angular doc is worse. Auth is base on tokens, no sessions. I reused the ideas from here https://github.com/mrgamer/angular-login-example https://github.com/mrgamer/angular-login-example def auth_required(f): @wraps(f) def wrapper(*args, **kwargs): token = request.headers.get("X-Token") if token is None: abort(400) user = User.verify_auth_token(token, app.config["SECRET_KEY"]) .... If you don't make very heavy SPA like photoshop, don't use angular.
- ermintrude 13y ago
  > Is there a special "API key" for your web app? And if there is, what's the point? Would the only reason to ever change that key be to force old clients to upgrade if the API changes?
tomchristie 13y ago
Built in pagination isn't something that's planned atm, tho typically I'd always return objects as the top level representation, and embed the pagination links inside that.
tomchristie 13y ago
> one example returns json array, what about JSON venerability? Side point: I don't have a reference for this, but from what I understand the JSON array vulnerability has long since been closed in all sane browsers.
ermintrude 13y ago
You should check out eve (http://python-eve.org http://python-eve.org) - it's amazing for rapid prototyping (if the fact it requires Mongo isn't an issue). I'm building an AngularJS + REST server using Eve for the server. It has saved me so much time that I'm putting my dev effort mainly into a comprehensive test suite because there's so little dev work to do (btw - I'm not the author, it's just the fastest framework I've found for developing REST APIs - and I've tried Django REST framework & tastypie).
- tomchristie 13y ago
  Quite an endorsement; I'll have to try to make the time to check that out properly. :)
- marekmroz 13y ago
  RE: Eve requiring Mongo, according to slide s 57-61 at https://speakerdeck.com/nicola/eve-rest-api-for-humans https://speakerdeck.com/nicola/eve-rest-api-for-humans Eve supports pluggable backends - is Mongo really needed?
  - ermintrude 13y ago
    I think the architecture supports pluggable backends, but AFAIK mongo is the best supported (and is the only one I know much about). There is a backend for elasticsearch (https://github.com/petrjasek/eve-elastic https://github.com/petrjasek/eve-elastic) but I've never used it and don't know how complete it is. From looking on github support for SQLAlchemy is slowly in the works.
- lukasm 13y ago
  it seems is pretty much the same as Sails in Node world
- notastartup 13y ago
  I'm considering also Sandman https://github.com/jeffknupp/sandman https://github.com/jeffknupp/sandman wondering how Eve stacks up to that. Sandman you just connect it to the DB and it's supposed to give you a REST api

by lukasm 13y ago

emillon 13y ago

> I spent last 3 months building AngularJS + Flask where the client talks to server only through REST. I've been wanting to do something like this for a certain time, so I have a few questions if you don't mind. How do you handle authentication? Tokens? Cookies? Is there a special "API key" for your web app?

lukasm 13y ago
Long story short - I went full hipster on that grunt + yeoman + bower + angular ui and my conclusion is http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c.jpg http://i3.kym-cdn.com/photos/images/newsfeed/000/439/835/47c... Too much complexity added to project. Going REST patch is problematic when you have to integrate with server-render style lib or service. SEO is shit. Angular doc is worse. Auth is base on tokens, no sessions. I reused the ideas from here https://github.com/mrgamer/angular-login-example https://github.com/mrgamer/angular-login-example def auth_required(f): @wraps(f) def wrapper(*args, **kwargs): token = request.headers.get("X-Token") if token is None: abort(400) user = User.verify_auth_token(token, app.config["SECRET_KEY"]) .... If you don't make very heavy SPA like photoshop, don't use angular.
ermintrude 13y ago
> Is there a special "API key" for your web app? And if there is, what's the point? Would the only reason to ever change that key be to force old clients to upgrade if the API changes?

tomchristie 13y ago

Built in pagination isn't something that's planned atm, tho typically I'd always return objects as the top level representation, and embed the pagination links inside that.

tomchristie 13y ago

> one example returns json array, what about JSON venerability? Side point: I don't have a reference for this, but from what I understand the JSON array vulnerability has long since been closed in all sane browsers.

ermintrude 13y ago

You should check out eve (http://python-eve.org http://python-eve.org) - it's amazing for rapid prototyping (if the fact it requires Mongo isn't an issue). I'm building an AngularJS + REST server using Eve for the server. It has saved me so much time that I'm putting my dev effort mainly into a comprehensive test suite because there's so little dev work to do (btw - I'm not the author, it's just the fastest framework I've found for developing REST APIs - and I've tried Django REST framework & tastypie).

tomchristie 13y ago
Quite an endorsement; I'll have to try to make the time to check that out properly. :)
marekmroz 13y ago
RE: Eve requiring Mongo, according to slide s 57-61 at https://speakerdeck.com/nicola/eve-rest-api-for-humans https://speakerdeck.com/nicola/eve-rest-api-for-humans Eve supports pluggable backends - is Mongo really needed?
- ermintrude 13y ago
  I think the architecture supports pluggable backends, but AFAIK mongo is the best supported (and is the only one I know much about). There is a backend for elasticsearch (https://github.com/petrjasek/eve-elastic https://github.com/petrjasek/eve-elastic) but I've never used it and don't know how complete it is. From looking on github support for SQLAlchemy is slowly in the works.
lukasm 13y ago
it seems is pretty much the same as Sails in Node world
notastartup 13y ago
I'm considering also Sandman https://github.com/jeffknupp/sandman https://github.com/jeffknupp/sandman wondering how Eve stacks up to that. Sandman you just connect it to the DB and it's supposed to give you a REST api