Article: Introduction to REST

by Vindhya Nagaraj

1. REST Introduction

The usage of Twitter, Amazon, Google Maps, e-bay and many other applications has become extensive. The ease of development and access of such applications is due to the implementation of a web service which is simple yet supports complex functionalities; called Representational State Transfer (REST).
Before starting with REST lets understand what a Web service is. A Web service is a software system designed to support interoperable machine-to-machine interaction over a network. In layman terms they are the calls made by the application to a service present on the web to perform the specified actions.
REST was introduced and defined in 2000 by Roy Fielding. Rest is a stateless architecture which uses a client-server, cacheable communication protocol HTTP. It is an Application Programming Interface (API) which performs all the functions using HTTP methods.

Features of RESTful Web Services:

1. Client-server module:
REST has uniform interface with different separates clients from servers. Servers and clients may be replaced and developed independently, as long as the interface between them is not altered.

2. Stateless:
The RESTful Web Service does not maintain state; the client–server communication is further constrained by no client context being stored on the server between requests. The server does not store any client specific data. Each request from the client contains all of the information necessary to service the request, and any session state is held in the client.

3. Cacheable:
REST web services allow the clients to cache the responses. However, responses must be implicitly or explicitly defined themselves as cacheable, or not. Well-managed caching partially or completely eliminates some client–server interactions, further improving scalability and performance.

4. Layered System:
A client cannot ordinarily tell whether it is connected directly to the end server, or to an intermediary along the way. Intermediary servers may improve system scalability by enabling load-balancing and by providing shared caches. However, proper security policies have to be enforced in order to prevent information leakage.

5. Code-on-Demand:
Servers can temporarily extend or customize the functionality of a client by the transfer of executable code. Examples of this may include compiled components such as Java applets and client-side scripts such as JavaScript
RESTful web services are the API calls which work like any other HTTP requests. In HTTP to access any page, a request is made to the corresponding URL. Similarly in REST, each resource will be assigned with a distinct URI(Uniform Resource Identifier). REST performs the following actions using the HTTP methods give below:
Action -> HTTP method
Create -> PUT
Read -> GET
Update -> POST
Delete -> DELETE

Advantages of RESTful Web services:
REST is stateless, simple, lightweight and fast and works on the standard HTTP protocol.
It uses a standardized XML messaging system.
It is time-conserving.
It supports custom coding.
It works on any operating system and programming language.
The resources are not restricted to a specific extension and it can be accessed in a various formats such as HTML, XML, plain text, PDF, JPEG, JSON, and others.

Difference between Simple Object access Protocol (SOAP) and REST

2. Deploying a simple RESTful web service
RESTful web service can be deployed using any language and it does not require a WSDL. I have used the Recess Framework to build the Restful web service.

The full article would be published soon in Hakin9 Magazine. Follow our website to not miss it!

About the author:
Vindhya Nagaraj is an Ethical Hacker working in the field of Information Security. She holds Engineering degree from VTU in Telecommunication. Detecting new challenges, approaches to break into the system and finding solutions to patch them and ensuring the data is secure is what keeps she on her toes and gives her the edge to explore and learn about various aspects of security. Pentesting web applications is her area of interest in the field of Information Security.