Reading-Notes

Reading

Review API Server Build

Explain the different between a query string parameter and a path parameter.

Query String Parameter:

• It’s like an extra piece of information you add at the end of a website’s address.
• You use key-value pairs separated by an equals sign (=) to specify what information you want.
• Multiple pieces of information are separated by an ampersand (&).
• It’s optional and used to modify or filter the results you get.

Path Parameter:

• It’s a special part of the website’s address itself, surrounded by curly braces ({}).
• It’s used to show a variable or changing part in the address.
• It helps to identify a specific resource or give more details to the server.
• For example, in a user profile page, the path parameter could represent the user’s unique ID.

Query string parameters are like extra notes you add at the end of a web address to ask for specific things, while path parameters are used within the address itself to show variable information.

What would our API URL with a path id parameter be given the following information:

Domain: http://our-site.com

v3

model name: stuff

id: things

http://our-site.com/v3/stuff/things

We have created a dynamic API with an “interface”. Describe how that interface works to a non-technical friend.

Think of the dynamic API interface like a talking robot that can help you with different things. It has buttons and menus that change based on what you want. You can ask the robot for information or tell it to do things. For example, you can ask it for the weather, or you can ask it to play your favorite song. The cool part is that the robot can learn new things and add more buttons and options. So if you suddenly want to know the news, the robot can add a button for that too. In short, the dynamic API interface is like a helpful robot that understands what you want and can do more things as it learns.

Review Auth Server Build

Describe how you would use middleware to implement basic and bearer auth.

Using Middleware for Basic and Bearer Authentication: To implement basic and bearer authentication in an Express/Node.js server, middleware is used. Middleware functions are like intermediate layers that intercept and process incoming requests before they reach the final route handler. For basic authentication, a middleware function can be created to validate the user’s credentials (username and password) sent in the request header. This middleware function would be placed before the route handler for the ‘/signin’ endpoint. It checks the credentials, verifies them against the user data stored in the database, and grants access if they are valid.

Bearer authentication is handled similarly. A middleware function can be created to verify the bearer token included in the request header (Authorization: Bearer ). This middleware function would typically be placed before the protected routes that require authentication. It checks the validity and integrity of the token, and if it's valid, allows the request to proceed to the route handler.

By using middleware in this way, the server can authenticate incoming requests and control access to specific endpoints based on the authentication method used (basic or bearer).

Describe the handshake necessary to implement OAuth.

OAuth Handshake:

• The handshake necessary to implement OAuth involves a series of steps:

• The user initiates the OAuth process by clicking on a “Sign in with” button (e.g., Google or GitHub) on a website.

• The website redirects the user to the respective OAuth provider (e.g., Google or GitHub) with some necessary information.

• The OAuth provider asks the user for permission to share their information with the website.

• If the user grants permission, the OAuth provider generates a unique access token for the user.

• The OAuth provider sends this access token back to the website.

• The website receives the access token and can use it to make requests on behalf of the user to the OAuth provider’s API.

• The website can then store the access token securely and associate it with the user’s account for future authentication and authorization.

Describe how Role Based Access Control works to a non-technical friend.

Role-Based Access Control is a system that determines what actions a user can perform within a system based on their assigned role. Each role has specific permissions or capabilities associated with it. When a user logs in, their role is identified, and the system allows or denies access to certain routes or functionalities based on that role. RBAC ensures that users can only perform actions that align with their assigned role, enhancing security and maintaining system integrity.

This site is open source. Improve this page.