Great talk! This completely laid out everything about REST APIs. With reasonable best practices too. Best practices that are indeed true to Facebook, Twitter, Google REST APIs. Thanks a lot for this.
I'd additionally: 1. Use X - header field instead of parameters like _body (for example X-H TTP-Method) 3. In post response return only Location to resource, no content. Well configured API client will follow redirection and fetch new resource (including browsers) 4. Use absolute or even relative links in JSON (no need to include domain) 5. Use PATCH for partial updates, and POST for issuing actions on resources. 6. Use underscore instead of camel case in JSON (readable; ruby client?)
Very nice and informative talk. One question on security aspect; what are the best practices (or what are the practices Stormpath follows) to handle XSS and CSRF? Thank you.
+Daniel Lima de Almeida there are several reasons as mentioned in the video. A few of those are - Metered API's - Not required in all (most) instances - Reduce serve latency