Api-Design

The Law of Demeter is important in object-oriented programming. But where does “Demeter” come from? AKA the “Principle of Least Knowledge,” here’s a simple example of the law: code that lets us ask an owner, “What is your dog’s breed?” class Dog belongs_to :owner belongs_to :breed def breed_name breed.name end end class Owner has_one :dog # ✅ Owner only knows about 'breed_name', # not what 'breed' and 'name' are. def dog_breed_name dog.breed_name end # ❌ Owner knows that dog has a 'breed', and # that 'breed' has a 'name.' def dog_breed_name dog.breed.name end end This name comes from the Demeter project, so named because the goddess Demeter is related to Zeus. So, in a way, the name and the idea aren’t related. But, I found this online: ...

Authentication and authorization are two distinct concepts. Yet, I’ve found they’re sometimes used interchangeably. In this post, I’d like to define these terms. Authentication is verifying who someone is. Authorization is verifying what someone may access. Authentication Authentication is the process of verifying who someone is. Consider a person trying to enter an airport terminal. TSA says: “Who are you?” and the person presents an ID. TSA verifies it’s a legitimate ID and that the person presenting it is the person shown on the ID. When both are true, we call that person authenticated. ...

When building a demo application, I believe you can often skip authentication. Picture this: a coding school student team demoing a project. Smart and creative folks with lots to offer. Yet they spend half of their limited building and demoing time on auth. Here’s a sample script from the demo: “So we click ’login’ and now we’re on the login page, which we know because the header says ‘Log in.’ Then, we can either log in, sign in, or reset our password. We’re going to log in with a username and password I set up before the demo. I just fill in the username ‘demo-user’, password ‘password’, click ‘submit’, and now… wait for it… I’m on my homepage. See my username in the navbar? That only shows up when I’m logged in.” ...

Today I’d like to explain the sub, or subject, registered claim of a JSON Web Token. Registered claims are predefined fields of the JWT that are not mandatory but recommended. Like all JWT claims, they must be unique. sub is the subject of the JWT– the user who requested the token, typically an email address. By using it, we can send and receive a small, unique piece of data about a user along with each request, without any additional requests. ...