HTTP APIs

Bits and tweets about HTTP based Application Programming Interfaces.

By @pmhsfelix

[HTTP APIs @http_apis]

The IANA registry for well-known URIs - https://t.co/DFMYeLsIe1

[HTTP APIs @http_apis]

"To address this, this memo defines a path prefix in HTTP(S) URIs for these "well-known locations", "/.well-known/"."
In https://t.co/3IyO91rTp3
(2/2)

[HTTP APIs @http_apis]

"It is increasingly common for Web-based protocols to require the discovery of policy or other information about a host ("site-wide metadata") before making a request."
(1/2)

[HTTP APIs @http_apis]

"The immutable HTTP response Cache-Control extension allows servers to identify resources that will not be updated during their freshness lifetime. This ensures that a client never needs to revalidate a cached fresh resource (...)"
In https://t.co/HoYmzTYlbw

[HTTP APIs @http_apis]

The OWASP "API Security Top 10 2019"
https://t.co/La54HnL8qe

[HTTP APIs @http_apis]

"PKCE vs. Nonce: Equivalent or Not?"
In https://t.co/7MEwfJpCTp
by @dfett42

[HTTP APIs @http_apis]

"The Link header field provides a means for serialising one or more links into HTTP headers."
In https://t.co/Jwbb85EcyR

[HTTP APIs @http_apis]

Early hints example from https://t.co/vWdbj5a25T

HTTP/1.1 103 Early Hints
Link: </style.css>; rel=preload; as=style
Link: </script.js>; rel=preload; as=script

HTTP/1.1 200 OK
Date: Fri, 26 May 2017 10:02:11 GMT
(...)

[HTTP APIs @http_apis]

"This memo introduces an informational HTTP status code that can be used to convey hints that help a client make preparations for processing the final response."
In https://t.co/vWdbj5a25T

[HTTP APIs @http_apis]

"acr - Authentication Context Class Reference - String specifying an Authentication Context Class Reference value that identifies the Authentication Context Class that the authentication performed satisfied"
In https://t.co/07ph5bfdOS

[HTTP APIs @http_apis]

"azp - Authorized Party - the party to which the ID Token was issued. (...) This Claim is only needed when the ID Token has a single audience value and that audience is different than the authorized party"
In https://t.co/07ph5bfdOS

[HTTP APIs @http_apis]

"The "aud" (audience) claim identifies the recipients that the JWT is intended for. Each principal intended to process the JWT MUST identify itself with a value in the audience claim."
In https://t.co/f8NrvPbe0X

[HTTP APIs @http_apis]

"The "sub" (subject) claim identifies the principal that is the subject of the JWT. The claims in a JWT are normally statements about the subject."
in https://t.co/UVhDghsbny

[HTTP APIs @http_apis]

"The "iss" (issuer) claim identifies the principal that issued the JWT."
In https://t.co/Zjb0NLn2Vn

[HTTP APIs @http_apis]

"What makes HTTP significantly different from RPC is that the requests are directed to resources using a generic interface with standard semantics that can be interpreted by intermediaries (..) "
In "HTTP is not RPC" by @fielding https://t.co/gliBBBYSs3

[HTTP APIs @http_apis]

"The Web is based on numerous standards that together make up the surface of the Web: By knowing and supporting those standards, problems can be solved in well-known ways."
By @dret, in https://t.co/LswFb1tb4s

[HTTP APIs @http_apis]

"If the same issuer can issue JWTs that are intended for use by more than one relying party or application, the JWT MUST contain an "aud" (audience) claim that can be used to determine whether the JWT is being used by an intended party (...)"
In https://t.co/AuvCqSWlRl

[HTTP APIs @http_apis]

"Sometimes, one kind of JWT can be confused for another. If a particular kind of JWT is subject to such confusion, that JWT can include an explicit JWT type value, and the validation rules can specify checking the type."
In https://t.co/6hK8iIcv0j

[HTTP APIs @http_apis]

"JSON Web Tokens (...) are URL-safe JSON-based security tokens that contain a set of claims that can be signed and/or encrypted.This (...) document updates RFC 7519 to provide actionable guidance leading to secure implementation and deployment of JWTs."
In https://t.co/CLbD7ozsjo

[HTTP APIs @http_apis]

"The OAuth 2.0 device authorization grant is designed for Internet-connected devices that either lack a browser to perform a user-agent-based authorization or are input constrained"
In "OAuth 2.0 Device Authorization Grant" https://t.co/MrLmfLzhxZ