"A web service is a software system designed to support interoperable machine-to-machine interaction over a network".

• Web services are client-server applications that communicate (mostly) over Hyper Text Transfer Protocol (HTTP)
• Web services are a standard means of achieving interoperability between software applications running on diverse platforms and frameworks.
• Web Services are highly extensible. Services can be loosely coupled to solve complex operations.
• Web Service is a way of realizing Service Oriented Architecture (SOA). SOA is a style of software design where services are provided by the application components through a communication protocol. The basic principle of SOA makes it possible to be loosely-coupled with Vendor, product, and technology. As per SOA, a service is an individual unit of functionality that can be accessed remotely and updated independently, for example, retrieving a banking card statement online.

Web Client

A web client is a software using which you can interact with the server where the web application is hosted. The most commonly used web clients are web browsers such as Google Chrome, Mozilla Firefox, Internet Explorer, etc.

Web Server

A web server is a software where the web application is hosted. It processes the request received from the client and sends the response back to the client. It runs on some physical system and listens to client request on a specific port. Apache Tomcat is one of the most widely used web server.

Uniform Resource Locator (URL)

URL stands for Universal Resource Locator. It used by the web client to locate the web server and resource. Every resource on the web has its own unique URL. The following is an example of URL:

http://infy.com:8080/InfyBank/jsps/welcome.jsp

http:// – It is the communication protocol used for server-client communication.
infy.com – It is the hostname of the server that maps to a unique IP address.
8080 – This is the port on which server is listening. It is optional and if not provided request will go to the default port of the protocol. 

Hypertext Transfer Protocol (HTTP)

It is a protocol of communication between client and server. A client sends an HTTP request for a resource and the server returns an HTTP response with the desired resource. The HTTP request contains information about the action that the client is requesting the server to perform.

GET method

The HTTP GET method is used to retrieve a resource. It means, “get the resource identified by this URL.”  

http://infy.com:8080/InfyBank?username=Tom

POST method

A POST request is used to send data to the server in order to be processed. It means,“post the data to the resource identified by this URL”. The data is sent as a body of the message.

An HTTP message sent by a server to a client is called an HTTP response. The initial line of an HTTP response is called the status line. It has three parts, separated by spaces: the HTTP version, a response status code that tells the result of the request, and an English phrase describing the status code. 

Web Container

Web applications are composed of web components such as servlets, Java Server Page (JSP). These web components gets executed to generate content based on client request. So they need an environment for their execution. This execution environment is called as a web container. Web server takes the help of web container for generating dynamic content. Some commonly used web containers are

• Apache Tomcat
• GlassFish
• Jetty

Application Server

A web application resides in an application server. The application server provides the web application with easy and managed access to the resources of the system. It also provides low-level services, such as the HTTP protocol implementation and database connection management. A web container is just a part of an application server.

SOA-Service Oriented Architecture

Uniform Interface

In REST anything that can be accessed or manipulated is a resource. For example, "customer", "order", "blog“ all are resources. Every resource has a representation (XML/JSON) and are uniquely identified by a Uniform Resource Identifier (URI). Resources are manipulated using GET, POST, PUT and DELETE methods of HTTP to perform read, create, update and delete of the resource. You can perform different operation on resources using different HTTP methods but with same URI.

Example : If a customer is a resource, then customer details can be added, deleted, updated or retrieved. If a blog is another resource, then the operations we can perform on the blog can be create a blog, read a blog, update a blog or delete a blog.

Stateless

The communication between service consumer (client) and service provider(server) must be stateless between requests. Stateless requires each request from a service consumer to contain all the necessary information for the service to understand the meaning of the request and all session state data should then be returned to the service consumer at the end of each request.

• The interaction that takes place between the service provider and consumer is stateless.
• Being stateless, the server will never store the state information of its clients. Rather, every request from a service consumer should carry all the necessary information to make the server understand and process the request.

Advantage: Statelessness ensures that each service consumer request can be treated independently by the service.

Client Server

Client-Server enforces the separation of concerns in the form of a client-server architecture, this helps establish a distributed architecture. This is the most foundational constraint.

Cacheable

Service consumers can cache and reuse response message data. HTTP GET, PUT and DELETE operations are cacheable. RESTful Web Services use HTTP protocol as a carrier for the data, they can use the metadata available in HTTP headers to enable caching. For example: Cache-Control headers are used to optimize caching for enhancing performance.

Layered System

REST based solution can comprise of multiple architectural layers. This constraint builds on client-server where in we add middleware component(s). Consumer may be communicating with a service residing in a middleware layer or the actual provider. A service does not need to be aware of whether its consumer is further communicating with other services or acting as a provider for another consumer.

Code-On-Demand

• This is an optional constraint which is primarily intended to allow client-side logic to be modified without doing changes in the server-side logic.
• For example, a service can be designed in such a way that it dynamically pushes part of the logic to the consumers. 

Advantage: Logic that is present in the client end (such as Web browsers) can be modified/maintained independently without affecting the logic at the server side.

What is RESTful Web Service?

Any web service which satisfies REST principles is called RESTful web service. These web services are usually exposed to third‐party applications as application programming interface (API). Popular sites such as Facebook, Twitter, and LinkedIn offer REST web services for accessing stored data.

REST Resources

In REST everything is a Resource (data/functionality/web page) and is uniquely identified by a Uniform Resource Identifier (URI).

REST URI Templates

When creating REST API's, you need to represent the structure of a URI rather than the URI itself. For example, in InfyBank application, the URI http://infybank.com/customers/2001 would fetch details of the customer whose id is 2001. Similarly, the URI http://infybank.com/customers/2002 would fetch details of the customer whose id is 2002. In this scenario structure of URI is important. URI templates provides a standard way for describing structure of URI. 

http://infybank.com/customers/{customerid}

Representation

Resources can be represented in many ways i.e: JSON/ XML/ HTML or any other type.

In the above example of http://www.infy.com/employees/john, 

JSON                                                XML

What does State Transfer mean?

When you make a request to a resource like http://www.infy.com/employees/john using HTTP, we may be asking for the current "state" of this resource or its desired "state". You can use the same URI to indicate that,  we want to  :

Retrieve the current value of an Employee John (current state)

Perform Update operation on employee John's data (desired state)  etc.

The server will understand which operation has to be invoked based on the HTTP method that was used to make a call. In short it means that a client and server exchange, representation of a resource, which reflects its current state(GET) or its desired state(PUT).

JAX-RS implementations

JAX-RS is simply a specification and we need actual implementations to write web services. There are many vendors in the market who adhere to the standards of JAX-RS such as, Jersey and RESTEasy.

Richardson Maturity Model (RMM)

The Richardson’s Maturity Model is used to divide REST based web services in different categories based on how much they follow REST principles. It was developed by Leonard Richardson. 

This is the basic level for a REST based web service. In this level single URI is used to expose the entire API. It uses a single HTTP method (typically POST or GET) to make remote procedure call on a single URI to perform operation on resources. SOAP based and XML RPC based web services comes in this level. 

Level 1

The services in this level have multiple URI's for every resource but uses only one HTTP method – generally POST – to perform all the operations. Since specific resource is identified by a unique URI services in this level are closer to REST principles than services in level zero. 

Level 2

The services in this level uses HTTP protocol and its methods and status codes along with URI’s to perform all the operations.  For example, to get the employees, we send a GET request with the URI /employees, and the server sends proper response 200 OK and to add a customer, we send a POST request with the URI /employees, and the server sends proper response 201 CREATED. Services which implements CRUD operations are Level 2 services.

Level 3

This is the most mature level for a service. It is the combination of Level 2 and HATEOAS (Hypermedia as the Engine of Application State). Services in this level provides responses with links to related resources and controls which tells service client what to do next.

Spring Boot by default reads the static resources such as HTML pages, CSS, Java script, images, etc. present in following locations in classpath:

• /static
• /public
• /resources
• /META-INF/resources

During application development, you might need to change code many times and for these changes to reflect in application, the application needs to be restarted. Spring Boot provides developer tools using which you can automate this process. To use developer tools, add Spring Boot Dev Tools dependency

Working Internals of Spring REST:

Spring REST requests are delegated to the DispatcherServlet that identifies the specific controller with the help of handler mapper. Then, the identified controller processes the request and renders the response. This response, in turn, reaches the dispatcher servlet and finally gets rendered to the client.

To develop REST API to expose its following functionalities:

1. Add a customer
2. Get all customers
3. Update customer details
4. Fetch details of particular customer
5. Delete a customer

To do this you have to create Spring controller class and implement the REST API endpoints in it. The methods in controller class which implement REST endpoints are called as REST controller methods. Now to implement above requirements 

@SpringBootApplication = @Configuration + @EnableAutoConfiguration + @ComponentScan

@RestController

This annotation is used to define REST controllers. It is a combination of @Controller and @ResponseBody annotation. @Controller annotation marks a class for discovery by component scanning. @ResponseBody tells Spring that all handler methods in the controller should have their return value written directly to the body of the response, rather than being carried in the model to a view for rendering.

@RequestMapping

• This annotation is used for mapping web requests onto methods that are available in the resource classes. It is capable of getting applied at both class and method levels. At method level, we use this annotation mostly to specify the HTTP method.

This annotation is used to map the HTTP requests to handler methods of REST controllers.  You can use it at class-level or method-level in a controller. The class-level @RequestMapping specifies that any handler methods in this controller will handle requests with specific request path or pattern while method-level makes mappings more specific to handler methods. By default, this annotation matches to all HTTP methods. But usually controller methods should be mapped to a specific HTTP method. For this, you can use method attribute in this annotation. 

• @GetMapping
• @PostMapping
• @PutMapping
• @DeleteMapping

Handling HTTP GET

Handling HTTP PUT

• version-1: Fetches the complete plan details that include plainId, planName, localRate and nationalRate
• GET http://localhost:8080/infytel/plans/v1/{planId} eg:http://localhost:8080/infytel/plans/v1/1
• version-2: Fetches only the localRate and nationalRate.
• GET http://localhost:8080/infytel/plans/v2/{planId} eg:http://localhost:8080/infytel/plans/v2/1

• CORS configuration on the REST controller methods
• CORS configuration on the REST controller itself 
• CORS configuration globally (common to the entire application)

Why to do exception handling?

This controller has infybank/customer/{customerId} mapping which takes customerId and returns the customer details if customerId is present.

If no customer is present with given customer id and Service class throws an exception with message Service.CUSTOMER_UNAVAILABE for non existent customer then this controller returns the following response

• Create a class annotated with @RestControllerAdvice
• Have methods annotated with @ExceptionHandler(value=NameoftheException) which takes the exception class as the value for which the method is the handler

Introduction to Bean Validation API

what to do if path variable or request parameter is invalid. For example, if you want to restrict the value of customerId in path variable between 1 and 100. This requires validation of path variable or request parameter. You can also do this validation using Bean Validation API. Lets see how to do this.

For this, annotate the controller class with @Validated annotation to tell Spring to validate path variables and request parameters. Then annotate the parameters of the handler methods which needs to be validated with constraint annotations.  

For example, if you want to specify that customerId should be between 1 and 100 then modify the controller class 

Why to secure REST API’s

API’s are accessible to everyone i.e. anyone can use these API’s to perform CRUD operations on the data. For example, the API’s we have developed for our InfyBank application can be used by anyone get the details of any customer and in the worst case anyone can delete or update the details of a customer. But this is not correct as only customers and employees of the bank can access these API’s. In other words, we need authentication of users of the application and only valid users should be allowed to access it.

After authentication of user you need to identify the kind of operations that the user can perform. For example, in our InfyBank application only employees having admin access should be able to add, update and delete the customer details. This means that the access to certain API’s has to be restricted based on the user's role. This calls for adding authorization to the application so that only users having right permission can access certain API's. 

So proper authentication and authorization is required for securing REST API's. Spring Security is the most popular framework used for securing REST API's.  It provides authentication and authorization for REST API's. 

OWASP (Open Web Application Security Project)

It is a non-profitable organization which works in the area of web application and mobile security. Its objective is to make people aware of common and critical security vulnerabilities and measures to avoid those vulnerabilities. As of this course creation, OWASP Top 10 2017 is the latest vulnerabilities list is as follows:

1. Injection

Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

2. Broken Authentication

Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities (temporarily or permanently).

3. Sensitive Data Exposure

Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.

4. XML External Entities (XXE)

Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal SMB file shares on unpatched Windows servers, internal port scanning, remote code execution, and denial of service attacks, such as the Billion Laughs attack.

5. Broken Access control

Restrictions on what authenticated users are allowed to do are not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users' accounts, view sensitive files, modify other users’ data, change access rights, etc.

6. Security misconfigurations

Security misconfiguration is the most common issue in the data, which is due in part to manual or ad hoc configuration (or not configuring at all), insecure default configurations, open S3 buckets, misconfigured HTTP headers, error messages containing sensitive information, not patching or upgrading systems, frameworks, dependencies, and components in a timely fashion (or at all).

7. Cross Site Scripting (XSS)

XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user supplied data using a browser API that can create JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

8. Insecure Deserialization

Insecure deserialization flaws occur when an application receives hostile serialized objects. Insecure deserialization leads to remote code execution. Even if deserialization flaws do not result in remote code execution, serialized objects can be replayed, tampered or deleted to spoof users, conduct injection attacks, and elevate privileges.

9. Using Components with known vulnerabilities

Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.

10. Insufficient logging and monitoring

Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

Authentication

It is the process of verifying the identity of the user i.e verify whether the user is the intended user or not. For example, swipe in/out system at turnstiles at the company entrances is the best example for authentication.

Authorization

It is the process of restricting the access to resources for authenticated users so that the person/system who is authorized to access the resource can access the same. For example, a company has many employees and all the employees can enter the company premises but entry to the server room is allowed only to few people.

• UsernamePasswordAuthenticationFilter: It performs the task of authentication.
• AnonymousAuthenticationFilter: It performs anonymous authentication. If authentication credentials are not present in request it creates an anonymous users. These users are  allowed to access API"s which does not require authentication.
• ExceptionTranslationFilter: It translates security exceptions to a proper HTTP response.
• FilterSecurityInterceptor: It performs authorization of resources. 

Spring Security provides multiples approaches for authentication and authorization. One of the approach is HTTP basic authentication. 

HTTP Basic authentication

• All the requests should be authenticated using HTTP basic authentication.
• The /customers API should be accessed by only users having ADMIN role.