The API Churn/Security Trade-Off (2016)

Summary

TLDR: Heavy client-side logic requires a trade off between API churn or an increasingly complex security model The Problem A recent article by Jean-Jacques Dubray, Why I No Longer Use MVC Frameworks sparked a long and interesting discussion on HackerNews which crystallized a fundamental problem I see with the current trend towards heavy client-side logic in web applications. Here is the start from that article, where Jean-Jacques lays out the problem: The worst part of my job these days is designing APIs for front-end developers. The conversation goes inevitably as: Dev – “So, this screen has data element x,y,z… could you please create an API with the response format {x: , y:, z: }” Me – “Ok” I don’t even argue anymore. Projects end up with a gazillion APIs tied to screens that change often, which, by “design” require changes in the API and before you know it, you end up with lots of APIs and for each API many form factors and platform variants. To summarize: if you are designing network API end points for a front end, you will end up tweaking and modifying the API to support your UI needs in an ad hoc and often chaotic manner. By letting something that, by its nature, is constantly in flux and “fiddly” (that is, the UI) determine the shape of your API, you end up thrashing it around, trying to keep up. For the remainder of this article, I will refer to this problem as API churn. The Solution The solution to the problem of API churn, if you are committed to the client side, is to increase the expressiveness of the API available on the client side. OK, so what does that mean? That means that you must begin surfacing more and more generalized data access and mutation functionality on the client side. You see this with general query languages such at GraphQL replacing multiple REST-ish and ad hoc API end points with fewer, but more expressive end points. This can be thought of as a move towards something like SQL (or whatever your data store’s natural query/mutation la...