⛳️ Votre API passe-t-elle le contrôle technique ?
8 likes3,256 views
The document discusses the evolution and best practices of application programming interfaces (APIs), emphasizing the importance of technical checks and adherence to established guidelines for reliability and performance. It outlines various control points, business requirements, and necessary security measures, including service level objectives (SLOs) and privacy considerations. The document also stresses the significance of maintaining backward compatibility and performance metrics for API development.
![Ensure backward-compatibility
Twitter
"Diffy [...] catch bugs without requiring developers to write many tests"
https://github.com/twitter/diffy](https://image.slidesharecdn.com/20190312-190410154206/85/Votre-API-passe-t-elle-le-controle-technique-95-320.jpg)
⛳️ Votre API passe-t-elle le contrôle technique ?
- 1. Votre API passe-t-elle le contrôle technique ?
- 3. François-Guillaume RIBREAU @FGRibreau Architect & Head of development @Ouest-France ! Available for consulting
- 4. François-Guillaume RIBREAU @FGRibreau Architect & Head of development @Ouest-France 🌟 SaaS founder of ! Available for consulting
- 5. François-Guillaume RIBREAU @FGRibreau Architect & Head of development @Ouest-France 🌟 SaaS founder of ! Available for consulting
- 6. François-Guillaume RIBREAU @FGRibreau Architect & Head of development @Ouest-France 🌟 SaaS founder of ! Available for consulting
- 8. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey, 1969 (50 yrs ago)
- 9. I am quite convinced that in fact computing will become a very important science. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey, 1969 (50 yrs ago)
- 10. I am quite convinced that in fact computing will become a very important science. But at the moment we are in a very primitive state of development; we don't know the basic principles yet and we must learn them first. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey, 1969 (50 yrs ago)
- 11. I am quite convinced that in fact computing will become a very important science. But at the moment we are in a very primitive state of development; we don't know the basic principles yet and we must learn them first. If universities spend their time teaching the state of the art, they will not discover these principles and that, surely, is what academics should be doing. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey, 1969 (50 yrs ago)
- 13. '60s API (only) for libraries http://bit.ly/2CenmM7 Application Programming Interface (API)
- 14. '60s API (only) for libraries '80-90s Remote access to procedural API (MoM/Queuing emerges) http://bit.ly/2CenmM7 Application Programming Interface (API)
- 15. '60s API (only) for libraries '80-90s Remote access to procedural API (MoM/Queuing emerges) '00s REpresentational State Transfer (REST, Roy Fielding) http://bit.ly/2CenmM7 Application Programming Interface (API)
- 16. '60s API (only) for libraries '80-90s Remote access to procedural API (MoM/Queuing emerges) '00s REpresentational State Transfer (REST, Roy Fielding) '10s Public APIs, platforms emerge, hipster RPC protocols... http://bit.ly/2CenmM7 Application Programming Interface (API)
- 18. Votre API passe-t-elle le contrôle technique ?
- 20. Contrôle Technique (kɔ̃.tʁol tɛk.nik) “Porte sur 9 fonctions déclinées en 131 points de contrôle et 410 défaillances.”
- 21. “A type of job aid used to reduce failure by compensating for potential limits of human memory and attention.” Checklist (/ˈtʃɛklɪst/) Contrôle Technique (kɔ̃.tʁol tɛk.nik) “Porte sur 9 fonctions déclinées en 131 points de contrôle et 410 défaillances.”
- 23. control points BUSINESS REQUIREMENTS ON-CALL RESPONSABILITY RISKS CRITICITY DATA-PRIVACY (PIA/AIDP) DEFINE SERVICE NAME HTTPS HSTS HEADER IAM AUTHORIZATION ACCESS VERSIONING CHANGELOG BACKWARD-COMPATIBILITY MAX SIMULTANEOUS CONNECTIONS LIMIT RATE-LIMITING QUOTA TIMEOUTS/RETRIES/CIRCUIT- BREAKERS FOR EVERY CALL CONFIGURE CORS X-CONTENT-TYPE: NOSNIFF X-FRAME-OPTIONS: DENY CONTENT-SECURITY-POLICIES FINGERPRINT PAGINATION SEARCH, SORTING AND FILTERING SUPPORT FIELD SELECTION SUPPORT FIELD EXPANSION UUID INSTEAD OF AUTO-INC USE SEMANTIC SHORTCUTS USE ASYNC HANDLING WHEN NECESSARY SUPPORT PUSH OVERALL CONSISTENCY OVERALL ERROR CONSISTENCY REMOVE SENSITIVE DATA RETURN MINIMUM OUTPUT DEFINE INDIRECTIONS MODEL WITH USAGE IN MIND SUPPORT I18N/G11N FUNCTIONAL ERRORS USE CDN HMAC SPLIT STATE AND LOGIC IMMUTABLE DATA AUDITABILITY SUPPORT PROD/TEST MODE SUPPORT MULTI-TENANT LEVERAGE TESTS POST-DEPLOY TESTS SMOKE-TESTS GENERATE DOCUMENTATION TEST DOCUMENTATION SDK/CLIENTS COST-EFFICIENCY CONTINUOUS DEPLOYMENT MULTI-REGION & GEO-DNS CACHING LOG SYSTEM USAGE MONITORING API USAGE MONITORING BUSINESS USAGE MONITORING PROFILING ERROR REPORTING ALERTING, WRITE RUNBOOKS HEALTH-CHECK TRACING STATUS PAGE BUG-BOUNTY SECURITY.TXT PORTAIL 70+
- 24. “Mettre le plus de contraintes en amont”
- 25. # Français “C'est en forgeant que l ’on devient forgeron.” “Mettre le plus de contraintes en amont”
- 26. # Français “C'est en forgeant que l ’on devient forgeron.” $ Finnois kukaan ei ole seppä syntyessään (personne n'est né forgeron) “Mettre le plus de contraintes en amont”
- 27. # Français “C'est en forgeant que l ’on devient forgeron.” % Allemand Übung macht den Meister (L’exercice/habitude fait le maître) $ Finnois kukaan ei ole seppä syntyessään (personne n'est né forgeron) “Mettre le plus de contraintes en amont”
- 28. # Français “C'est en forgeant que l ’on devient forgeron.” % Allemand Übung macht den Meister (L’exercice/habitude fait le maître) $ Finnois kukaan ei ole seppä syntyessään (personne n'est né forgeron) & Japonais NaraWaNu Kyô Ha YoMeNu (Il est impossible de réciter un soûtra sans l'apprendre auparavant) “Mettre le plus de contraintes en amont”
- 30. What are your goals?
- 31. What are your goals?
- 34. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Objectives (SLO) Define business requirements
- 35. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Objectives (SLO) “Must be measurable, with a time period and specify where and how to measure it. Define business requirements
- 36. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Objectives (SLO) “Must be measurable, with a time period and specify where and how to measure it. Drives your dashboards and alerts.” Define business requirements
- 37. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Objectives (SLO) “Must be measurable, with a time period and specify where and how to measure it. Drives your dashboards and alerts.” Define business requirements “95% of chart generation requests latency will be lower than 400ms over the month”
- 38. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Indicators (SLI) Define business requirements
- 39. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Indicators (SLI) Define business requirements Metrics. e.g. error ratios, latency, query per seconds, response time, uptime
- 40. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Agreements 💰 (SLA) Define business requirements
- 41. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Agreements 💰 (SLA) Define business requirements "an explicit or implicit contract with your users that includes consequences of meeting (or missing) the SLOs they contain" — SRE Book
- 44. Risks Consider illegitimate access to data. What risks? Likelihood? Consider illegitimate data change. What risks? Likelihood? Consider data disappearance. What risks? Likelihood?
- 45. Risks Consider illegitimate access to data. What risks? Likelihood? Consider illegitimate data change. What risks? Likelihood? Consider data disappearance. What risks? Likelihood? Data-Privacy (e.g. PIA - Privacy Impact Assessment) Does the API collect sensitive data? (e.g. political opinion, sexual orientation…) Does the API evaluate or note people? Does the API handle data about vulnerable people? ...
- 47. “There are only two hard things in CS: cache invalidation and naming things” — Phil Karlton Define service name
- 49. ups ( Define service name
- 50. ups ( rcpu 🤷 Define service name
- 51. ups ( rcpu 🤷 ghostbusters * Define service name
- 52. ups ( rcpu 🤷 ghostbusters * thanos-service 🙎 Define service name
- 53. ups ( rcpu 🤷 ghostbusters * thanos-service 🙎 user-preference ✅ Define service name
- 55. “Le nommage doit être ennuyeux” ✅ Descriptive & unambiguous ✅ Transparent ✅ Respect SSoT/SoC
- 57. Use an Identity & Access Management service (IAM)
- 58. IAM 🎭 Authentication 👮 Authorization 🗂 Audit #SSoT #SoC
- 64. http://bit.ly/2TW4s6Q Charts Product Team CMS Product Team BP-Editorial Product Team BP-Services Product Team
- 65. http://bit.ly/2TW4s6Q “L'entreprise est une plateforme sur laquelle reposent les équipes” Charts Product Team CMS Product Team BP-Editorial Product Team BP-Services Product Team
- 68. http://bit.ly/2UFvPPZ SaaS tools (outside perimeter) 🕳
- 69. http://bit.ly/2UFvPPZ SaaS tools (outside perimeter) 🕳 Employee 💻 malware/trojans
- 70. We don't live in the '90s anymore. Build with untrusted network in mind. Forget the unsafe trusted network paradigm. You do want Application Segmentation (zero trust). http://bit.ly/2UFvPPZ SaaS tools (outside perimeter) 🕳 Employee 💻 malware/trojans
- 72. Use semver
- 74. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html Version your API accept: application/vnd.github.v3+json ...through mime headers (standard)
- 75. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html ... sub-domain {version}.domain.com Version your API accept: application/vnd.github.v3+json ...through mime headers (standard)
- 76. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html ... sub-domain {version}.domain.com ... path (mainly RPC over HTTP) api.twitter.com/v1/ api.twitter.com/1.1/ api.twilio.com/2010-04-01/ Version your API accept: application/vnd.github.v3+json ...through mime headers (standard)
- 77. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html ... sub-domain {version}.domain.com ... path (mainly RPC over HTTP) api.twitter.com/v1/ api.twitter.com/1.1/ api.twilio.com/2010-04-01/ Version your API ... query-string /?v={version} accept: application/vnd.github.v3+json ...through mime headers (standard)
- 79. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html Version your API ...and then there is
- 80. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api 1) authenticated api request API reverse-engineered
- 81. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate app request 1) authenticated api request API reverse-engineered
- 82. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate app request 3) get active app version 1) authenticated api request API reverse-engineered
- 83. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate app request 3) get active app version 4) down-migration middlewares 1) authenticated api request API reverse-engineered
- 84. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate app request 3) get active app version 4) down-migration middlewares 5) execute request 1) authenticated api request API reverse-engineered
- 85. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate app request 3) get active app version 4) down-migration middlewares 5) execute request 6) up-migration middlewares 1) authenticated api request API reverse-engineered
- 90. “Be conservative in what you send, be liberal in what you accept” — Postel's law (the Robustness Principle) Ensure backward-compatibility
- 92. Ensure backward-compatibility API = Application Programming Interface
- 93. Ensure backward-compatibility API = Application Programming Interface Interface ∈ Contract
- 94. Ensure backward-compatibility API = Application Programming Interface Interface ∈ Contract Find a way to test contracts
- 95. Ensure backward-compatibility Twitter "Diffy [...] catch bugs without requiring developers to write many tests" https://github.com/twitter/diffy
- 97. Support pagination Support search Support sorting Support filtering Support field selection Support field expansion
- 99. Support pagination ⚠ "yeah... maybe later" ⚠ O(n) 3
- 100. Support pagination “Tout limiter dans l'espace et dans le temps” ⚠ "yeah... maybe later" ⚠ O(n) 3
- 101. https://www.youtube.com/watch?v=UKrS_eXZfHw “Choisir entre une API RPC, SOAP, REST, GraphQL et si le problème était ailleurs ?”
- 102. “Mettre le plus de contraintes en amont”
- 104. Access-Control-Allow-Origin: ... (HTTP specific headers)
- 105. Access-Control-Allow-Origin: ... x-content-type: no-sniff (HTTP specific headers)
- 106. Access-Control-Allow-Origin: ... x-content-type: no-sniff x-frame-options: deny (HTTP specific headers)
- 107. Access-Control-Allow-Origin: ... x-content-type: no-sniff x-frame-options: deny Content-Security-Policy: ... (HTTP specific headers)
- 108. Remove fingerprints 👁 - nginx/apache/framework name & versions - load-balancer/proxy/CDN
- 110. Split state & logic
- 111. Split state & logic Save data as immutable
- 112. Split state & logic Save data as immutable Support auditability
- 113. Leverage an object storage for files (AWS S3 / GCP Storage / Riak S2 / Minio) Split state & logic
- 114. Support multi-tenant
- 116. dev api-talks Talks
- 135. production dev staging IAM IAM production dev staging api-talks api-talks api-talks production dev staging IAM IAM IAM Talks IAM Twitter API Twitter TeamTeam talks- dev (app) talks- staging (app) talks- production (app) Team “Les équipes pointent sur la production des autres” PrivatePublic
- 136. production dev staging IAM IAM production dev staging api-talks api-talks api-talks production dev staging IAM IAM IAM Talks IAM Twitter API Twitter TeamTeam talks- dev (app) talks- staging (app) talks- production (app) Team “Les équipes pointent sur la production des autres” production (realm) talks- staging (realm) talks- dev (realm)
- 137. production dev staging IAM IAM production dev staging api-talks api-talks api-talks production dev staging IAM IAM IAM Talks IAM Twitter API Twitter TeamTeam talks- dev (app) talks- staging (app) talks- production (app) Team “Les équipes pointent sur la production des autres” production (realm) talks- staging (realm) talks- dev (realm) production (????)
- 138. dev staging production api-talks production (organization) api-talks api-talks Support multi-tenant
- 139. dev staging production api-talks production (organization) api-talks api-talks Design primitives (e.g. realm, app, organization, website) to unleash your teams productivity 😇 and business opportunities 💵 Support multi-tenant
- 141. Your company is a platform, everything can be sold.
- 142. Your company is a platform, everything can be sold. Your company is a user — like anyone else — of your API.
- 143. Your company is a platform, everything can be sold. Your company is a user — like anyone else — of your API. Use your IAM Luke! Morpheus (not sure about this one)
- 145. "How do I run my system/e2e tests?" https://amzn.to/2TfqaOI
- 146. "How do I run performance tests?" "How do I run my system/e2e tests?" https://amzn.to/2TfqaOI
- 147. "How do I run performance tests?" "How do I run my system/e2e tests?" https://amzn.to/2TfqaOI
- 151. IAM
- 158. Verifying webhooks X-Shopify-Hmac-SHA256 HTTP header Stripe-Signature HTTP headersigned_request HTTP POST variable
- 159. https://image-charts.com/chart ?chs=700x300 &chxt=x,y &chl=2018|2017|2015 &chd=t:60,40,20 &cht=pa &chdl=Image|Charts|Rocks &chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a, 0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1 &chan How to protect my API monetization model?
- 160. https://image-charts.com/chart ?chs=700x300 &chxt=x,y &chl=2018|2017|2015 &chd=t:60,40,20 &cht=pa &chdl=Image|Charts|Rocks &chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a, 0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1 &chan How to protect my API monetization model?
- 165. https://image-charts.com/chart ?chs=700x300 &chxt=x,y &chl=2018|2017|2015 &chd=t:60,40,20 &cht=pa &chdl=Image|Charts|Rocks &chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a, 0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1 &chan &icac=fgribreau &ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27 ✅ Signed URL ✅ Removed watermark ✅ Available extra-features
- 166. https://image-charts.com/chart ?chs=700x300 &chxt=x,y &chl=2018|2017|2015 &chd=t:60,40,20 &cht=pa &chdl=Image|Charts|Rocks &chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a, 0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1 &chan &icac=fgribreau &ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27 ✅ Signed URL ✅ Removed watermark ✅ Available extra-features ⚠ Caching
- 167. Define timeouts for every call (pg: statement_timeout) Implement retries (e.g. exponential-backoff) Define circuit-breakers
- 168. Define timeouts for every call (pg: statement_timeout) Implement retries (e.g. exponential-backoff) Define circuit-breakers “Tout limiter dans l'espace et dans le temps”
- 169. Leverage tests Write post-deploy tests Write smoke-tests (black-box testing)
- 170. Before production
- 171. Set max simultaneous connections limit Set rate-limiting
- 172. Set max simultaneous connections limit Set rate-limiting “Tout limiter dans l'espace et dans le temps”
- 176. “Monitoring sans alerting ne sert à rien” http://bit.ly/2JlncJ1
- 178. Generate documentation Generate SDK/clients Test documentation 😑
- 179. https://www.youtube.com/watch?v=g6Yg2e1cDe8 “Construire et automatiser son SaaS grâce à une spécification OpenAPI/Swagger”
- 181. Leverage CI/CD 😑
- 183. "Restart" deployment
- 185. "Restart" deployment Blue/green deployment Rolling-updates deployment (req. n-1 backward-compat) (commodity: PaaS & CaaS)
- 186. "Restart" deployment Blue/green deployment Rolling-updates deployment (req. n-1 backward-compat) (commodity: PaaS & CaaS) Dark-launch + Canarying + rolling-updates (req. n-1 backward-compat) (commodity: GoReplay, Istio)
- 187. After production
- 189. Expose api in status page Promote bug-bounty Expose .well-known/security.txt Expose .well-known/dnt-policy.txt Expose in portail
- 190. control points BUSINESS REQUIREMENTS ON-CALL RESPONSABILITY RISKS CRITICITY DATA-PRIVACY (PIA/AIDP) DEFINE SERVICE NAME HTTPS HSTS HEADER IAM AUTHORIZATION ACCESS VERSIONING CHANGELOG BACKWARD-COMPATIBILITY MAX SIMULTANEOUS CONNECTIONS LIMIT RATE-LIMITING QUOTA TIMEOUTS/RETRIES/CIRCUIT- BREAKERS FOR EVERY CALL CONFIGURE CORS X-CONTENT-TYPE: NOSNIFF X-FRAME-OPTIONS: DENY CONTENT-SECURITY-POLICIES FINGERPRINT PAGINATION SEARCH, SORTING AND FILTERING SUPPORT FIELD SELECTION SUPPORT FIELD EXPANSION UUID INSTEAD OF AUTO-INC USE SEMANTIC SHORTCUTS USE ASYNC HANDLING WHEN NECESSARY SUPPORT PUSH OVERALL CONSISTENCY OVERALL ERROR CONSISTENCY REMOVE SENSITIVE DATA RETURN MINIMUM OUTPUT DEFINE INDIRECTIONS MODEL WITH USAGE IN MIND SUPPORT I18N/G11N FUNCTIONAL ERRORS USE CDN HMAC SPLIT STATE AND LOGIC IMMUTABLE DATA AUDITABILITY SUPPORT PROD/TEST MODE SUPPORT MULTI-TENANT LEVERAGE TESTS POST-DEPLOY TESTS SMOKE-TESTS GENERATE DOCUMENTATION TEST DOCUMENTATION SDK/CLIENTS COST-EFFICIENCY CONTINUOUS DEPLOYMENT MULTI-REGION & GEO-DNS CACHING LOG SYSTEM USAGE MONITORING API USAGE MONITORING BUSINESS USAGE MONITORING PROFILING ERROR REPORTING ALERTING, WRITE RUNBOOKS HEALTH-CHECK TRACING STATUS PAGE BUG-BOUNTY SECURITY.TXT PORTAIL 70+
- 191. Questions? @FGRibreau image-charts.com No more server-side rendering pain, 1 url = 1 chart redsmin.com Free plans for Redis administration & monitoring getnobullshit.com (Receive the 70+ points API checklist) 60 principes pratiques fondamentaux, applicables quotidiennement de la petite à la grande entreprise du développeur au CTO du tech-lead à l'architecte.
- 192. categories13
- 193. modeling performance scalability security recoverability backward compatibility deployment monitoring reporting system health troubleshooting reliability availability documenting categories13
- 194. BONUS
- 195. Define indirections
- 196. Use UUID instead of auto-increment Use semantic shortcuts Model with usage in mind
- 197. Configure health-check Log everything Configure system monitoring Configure API monitoring Configure business usage monitoring Configure profiling Implement error reporting Setup tracing 😑
- 198. Add server-side caching Leverage defensive-caching (grace mode) Support client-side caching 😑
- 200. ⚠ How do I let my S3 API users securely expose files/data?
- 201. ✅ Control data access ✅ (optional) url expiration https://s3.amazonaws.com/{S3_BUCKET}/{path} ?Expires={expire_date} &AWSAccessKeyId={S3_ACCESS_KEY_ID} &Signature={signature} Note: signature through query string or Authorization header
- 202. Add HTTPS Add HSTS header
- 203. https://mzl.la/2T863Cl add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; Add HTTPS Add HSTS header
- 204. Questions? @FGRibreau image-charts.com No more server-side rendering pain, 1 url = 1 chart redsmin.com Free plans for Redis administration & monitoring getnobullshit.com (Receive the 70+ points API checklist) 60 principes pratiques fondamentaux, applicables quotidiennement de la petite à la grande entreprise du développeur au CTO du tech-lead à l'architecte.