1. WS-* vs. RESTful Services
Cesare Pautasso
Faculty of Informatics, USI Lugano, Switzerland
c.pautasso@ieee.org
http://www.pautasso.info
http://twitter.com/pautasso
30.6.2010

2. Abstract
Recent technology trends in Web Services indicate that a solution
eliminating the perceived complexity of the WS-* standard technology
stack may be in sight: advocates of REpresentational State Transfer
(REST) have come to believe that their ideas explaining why the World
Wide Web works are just as applicable to solve enterprise application
integration problems and to radically simplify the plumbing required to
build service-oriented architectures. In this tutorial we take a scientific
look at the WS-* vs. REST debate by presenting a technical comparison
based on architectural principles and decisions. We show that the two
approaches differ in the number of architectural decisions that must be
made and in the number of available alternatives. This discrepancy
between freedom-from-choice and freedom-of-choice quantitatively
explains the perceived complexity difference. We also show that there
are significant differences in the consequences of certain decisions in
terms of resulting development and maintenance costs. Our
comparison helps technical decision makers to assess the two
integration technologies more objectively and select the one that best
fits their needs: REST is well suited for basic, ad hoc integration
scenarios à la mashup, WS-* is more mature and addresses advanced
quality of service requirements commonly found in enterprise
computing.
©2009-2010 - Cesare Pautasso - 30.6.2010 2

3. About Cesare Pautasso
• Assistant Professor at the Faculty of Informatics,
University of Lugano, Switzerland (since Sept 2007)
• Research Projects:
• SOSOA – Self-Organizing Service Oriented Architectures
• CLAVOS – Continuous Lifelong Analysis and Verification
of Open Services
• BPEL for REST
• Researcher at IBM Zurich Research Lab (2007)
• Post-Doc at ETH Zürich
• Software:
JOpera: Process Support for more than Web services
http://www.jopera.org/
• Ph.D. at ETH Zürich, Switzerland (2004)
• Laurea Politecnico di Milano (2000)
• Representations:
http://www.pautasso.info/ (Web)
http://twitter.com/pautasso/ (Twitter Feed)
©2010 Cesare Pautasso - 30.6.2010 3

4. WS-* Standards Stack
©2009-2010 - Cesare Pautasso - 30.6.2010 4

5. RESTful Services Standards
AtomPub
RSS Atom
XML JSON
URI HTTP
MIME SSL/TLS
©2009-2010 - Cesare Pautasso - 30.6.2010 5

6. Is REST really used?
©2010 - Cesare Pautasso 6

7. Is REST really used?
Atom, 2%
Gdata, 1%
XMPP, 0%
JavaScript, 6%
XML-RPC, 2%
SOAP, 17% JSON-RPC, 0%
SMS, 2042 APIs
0%
RSS, 1%
ProgrammableWeb.com
30.6.2010
REST,
71%
©2010 - Cesare Pautasso 7

8. Web Sites (1992)
Web HTML Web
Browser HTTP Server
WS-* Web Services (2000)
SOAP WSDL
Client XML Server
(HTTP)
©2009-2010 - Cesare Pautasso - 30.6.2010 8

9. RESTful Web Services (2007)
PO-XML
RSS/Atom
JSON
WADL
Web
Client
HTTP Server
WS-* Web Services (2000)
SOAP WSDL
Client XML Server
(HTTP)
©2009-2010 - Cesare Pautasso - 30.6.2010 9

10. Outline
1.Introduction
to RESTful Web
Services
2. Comparing REST and WS-*
©2009-2010 - Cesare Pautasso - 30.6.2010 10

11. REST in one slide
 Web Services expose their
data and functionality trough PUT
resources identified by URI
R
 Uniform Interface Principle: GET
Clients interact with resources POST
through a fix set of verbs. DELETE
Example HTTP:
GET (read), POST (create), PUT (update), DELETE
 Multiple representations for the same resource
 Hyperlinks model resource relationships and valid
state transitions for dynamic protocol description
and discovery
©2010 - Cesare Pautasso 11

12. URI - Uniform Resource Identifier
 Internet Standard for resource naming and identification
(originally from 1994, revised until 2005)
 Examples:
http://tools.ietf.org/html/rfc3986
URI Scheme Authority Path
https://www.google.ch/search?q=rest&start=10#1
Query Fragment
 REST does not advocate the use of “nice” URIs
 In most HTTP stacks URIs cannot have arbitrary length (4Kb)
 #Fragments are not even sent to the server
©2009-2010 - Cesare Pautasso - 30.6.2010 12

13. What is a “nice” URI?
A RESTful service is much more than just a set of nice URIs
http://map.search.ch/lugano
http://maps.google.com/lugano
http://maps.google.com/maps?f=q&hl=en&q=lugano,
+switzerland&layer=&ie=UTF8&z=12&om=1&iwloc=addr
©2009-2010 - Cesare Pautasso - 30.6.2010 13

14. URI Design Guidelines
 Prefer Nouns to Verbs GET /book?isbn=24&action=delete
 Keep your URIs short DELETE /book/24
 If possible follow a
“positional” parameter-  Note: REST URIs are opaque
passing scheme for identifiers that are meant to
algorithmic resource query be discovered by following
strings (instead of the hyperlinks and not
key=value&p=v encoding) constructed by the client
 Some use URI postfixes to  This may break the
specify the content type abstraction
 Do not change URIs  Warning: URI Templates
 Use redirection if you really introduce coupling between
need to change them client and server
©2009-2010 - Cesare Pautasso - 30.6.2010 14

15. URI Templates
 URI Templates specify how to construct and parse
parametric URIs.
 On the service they are often used to configure “routing rules”
 On the client they are used to instantiate URIs from local parameters
parameters URI
URI Template URI Template
client service
URI parameters
 Do not hardcode URIs in the client!
 Do not hardcode URI templates in the client!
 Reduce coupling by fetching the URI template from the
service dynamically and fill them out on the client
©2009-2010 - Cesare Pautasso - 30.6.2010 15

16. URI Template Examples
 From http://bitworking.org/projects/URI-Templates/
 Template:
http://www.myservice.com/order/{oid}/item/{iid}
 Example URI:
http://www.myservice.com/order/XYZ/item/12345
 Template:
http://www.google.com/search?{-join|&|q,num}
 Example URI:
http://www.google.com/search?q=REST&num=10
©2009-2010 - Cesare Pautasso - 30.6.2010 16

17. Uniform Interface Constraint
IDEM
HTTP SAFE
POTENT
Create a
POST sub resource NO NO
Retrieve the current
GET state of the resource YES YES
Initialize or update
the state of a
PUT resource NO YES
at the given URI
Clear a resource,
DELETE after the URI is no NO YES
longer valid
©2009-2010 - Cesare Pautasso - 30.6.2010 17

18. POST vs. GET
 GET is a read-only operation.
It can be repeated without
affecting the state of the
resource (idempotent) and
can be cached.
Note: this does not mean that
the same representation will
be returned every time. Web browsers warn
 POST is a read-write you when refreshing
operation and may change a page generated
the state of the resource and with POST
provoke side effects on the
server.
©2009-2010 - Cesare Pautasso - 30.6.2010 18

19. POST vs. PUT
What is the right way of creating resources (initialize their state)?
PUT /resource/{id}
201 Created
Problem: How to ensure resource {id} is unique?
(Resources can be created by multiple clients concurrently)
Solution 1: let the client choose a unique id (e.g., GUID)
POST /resource
301 Moved Permanently
Location: /resource/{id}
Solution 2: let the server compute the unique id
Problem: Duplicate instances may be created if requests are
repeated due to unreliable communication
©2009-2010 - Cesare Pautasso - 30.6.2010 19

20. REST Architectural Elements
Client/Server Layered Stateless Communication Cache
Proxy
User Agent Origin Server
Gateway
Connector (HTTP) Cache
©2009-2010 - Cesare Pautasso - 30.6.2010 20

21. Basic Setup
HTTP
User Agent Origin Server
Adding Caching
HTTP HTTP
Caching Origin Server User Agent Caching
User Agent Origin Server
HTTP
Caching Caching
User Agent Origin Server
©2009-2010 - Cesare Pautasso - 30.6.2010 21

22. Proxy or Gateway?
Intermediaries forward (and may translate) requests and responses
HTTP HTTP
Client Proxy Origin Server
A proxy is chosen by the Client (for caching, or access control)
HTTP HTTP
Client Gateway Origin Server
The use of a gateway (or reverse proxy) is imposed by the server
©2009-2010 - Cesare Pautasso - 30.6.2010 22

23. Design Methodology
1. Identify resources to be exposed as
services (e.g., yearly risk report, book
DELETE
catalog, purchase order, open bugs,
POST
polls and votes)
GET
PUT
2. Model relationships (e.g., containment,
reference, state transitions) between /loan    
resources with hyperlinks that can be
followed to get more details (or perform /balance    
state transitions)
/client    
3. Define “nice” URIs to address the
resources /book    
4. Understand what it means to do a GET,
POST, PUT, DELETE for each resource /order  ?  
(and whether it is allowed or not)
5. Design and document resource
representations /soap    
6. Implement and deploy on Web server
7. Test with a Web browser
©2009-2010 - Cesare Pautasso - 30.6.2010 23

24. Design Space
M Representations (Variable)
©2009-2010 - Cesare Pautasso - 30.6.2010 24

25. Simple Doodle API Example
1. Resources:
DELETE
polls and votes
POST
2. Containment Relationship:
GET
PUT
poll /poll    
{id1} /poll/{id}    
vote /poll/{id}/vote    
{id4} /poll/{id}/vote/{id}    ?
{id5} 3. URIs embed IDs of “child”
instance resources
4. POST on the container is used to
{id2} create child resources
5. PUT/DELETE for updating and
{id3} removing child resources
©2009-2010 - Cesare Pautasso - 30.6.2010 25

26. Simple Doodle API Example
1. Creating a poll
(transfer the state of a new poll on the Doodle service)
/poll
/poll/090331x
/poll/090331x/vote
POST /poll GET /poll/090331x
<options>A,B,C</options>
200 OK
201 Created <options>A,B,C</options>
Location: /poll/090331x <votes href=“/vote”/>
2. Reading a poll
(transfer the state of the poll from the Doodle service)
©2009-2010 - Cesare Pautasso - 30.6.2010 26

27. Simple Doodle API Example
 Participating in a poll by creating a new vote sub-resource
/poll
/poll/090331x
/poll/090331x/vote
/poll/090331x/vote/1
POST /poll/090331x/vote GET /poll/090331x
<name>C. Pautasso</name>
<choice>B</choice> 200 OK
<options>A,B,C</options>
201 Created <votes><vote id=“1”>
Location: <name>C. Pautasso</name>
/poll/090331x/vote/1 <choice>B</choice>
</vote></votes>
©2009-2010 - Cesare Pautasso - 30.6.2010 27

28. Simple Doodle API Example
 Existing votes can be updated (access control headers not shown)
/poll
/poll/090331x
/poll/090331x/vote
/poll/090331x/vote/1
PUT /poll/090331x/vote/1 GET /poll/090331x
<name>C. Pautasso</name>
<choice>C</choice> 200 OK
<options>A,B,C</options>
200 OK <votes><vote id=“/1”>
<name>C. Pautasso</name>
<choice>C</choice>
</vote></votes>
©2009-2010 - Cesare Pautasso - 30.6.2010 28

29. Simple Doodle API Example
 Polls can be deleted once a decision has been made
/poll
/poll/090331x
/poll/090331x/vote
/poll/090331x/vote/1
DELETE /poll/090331x GET /poll/090331x
200 OK 404 Not Found
©2009-2010 - Cesare Pautasso - 30.6.2010 29

30. The End to End View
R GET
C
A B
PUT GET
 The resource acts as an communication
medium that allows services to exchange
representations of their state
 This is not equivalent to sending and receiving
messages from a bus
©2009-2010 - Cesare Pautasso - 30.6.2010 30

31. Real Doodle Demo
• Info on the real Doodle API:
http://doodle.com/xsd1/RESTfulDoodle.pdf
• Lightweight demo with Poster Firefox Extension:
http://addons.mozilla.org/en-US/firefox/addon/2691
©2009-2010 - Cesare Pautasso - 30.6.2010 31

32. 1. Create Poll
POST http://doodle-test.com/api1WithoutAccessControl/polls/
Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?><poll
xmlns="http://doodle.com/xsd1"><type>TEXT</type><extensions
rowConstraint="1"/><hidden>false</hidden><writeOnce>false</writeOnce
><requireAddress>false</requireAddress><requireEMail>false</requireEM
ail><requirePhone>false</requirePhone><byInvitationOnly>false</byInvitat
ionOnly><levels>2</levels><state>OPEN</state><title>How is the tutorial
going?</title><description></description><initiator><name>Cesare
Pautasso</name><userId></userId><eMailAddress>test@jopera.org</eM
ailAddress></initiator><options><option>too fast</option><option>right
speed</option><option>too
slow</option></options><participants></participants><comments></com
ments></poll>
Content-Location: {id}
GET http://doodle-test.com/api1WithoutAccessControl/polls/{id}
©2009-2010 - Cesare Pautasso - 30.6.2010 32

33. 2. Vote
POST http://doodle-test.com/api1WithoutAccessControl/polls/{id}/participants
Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>
<participant xmlns="http://doodle.com/xsd1"><name>Cesare
Pautasso</name><preferences><option>0</option><option>1</option><
option>0</option></preferences></participant>
©2009-2010 - Cesare Pautasso - 30.6.2010 33

34. Antipatterns - REST vs. HTTP
REST HTTP
“RPC”
RESTful HTTP
©2009-2010 - Cesare Pautasso - 30.6.2010 34

35. Richardson Maturity Model
0. HTTP as an RPC Protocol
(Tunnel POST+POX or POST+JSON)
I. Multiple Resource URIs
(Fine-Grained Global Addressability)
II. Uniform HTTP Verbs
(Contract Standardization)
III. Hypermedia
(Protocol Discoverability)
 A REST API needs to include levels I, II, III
 Degrees of RESTfulness?
©2009-2010 - Cesare Pautasso - 30.6.2010 35

36. HTTP as a tunnel
 Tunnel through one HTTP Method
GET /api?method=addCustomer&name=Wilde
GET /api?method=deleteCustomer&id=42
GET /api?method=getCustomerName&id=42
GET /api?method=findCustomers&name=Wilde*
 Everything through GET
• Advantage: Easy to test from a Browser address bar
(the “action” is represented in the resource URI)
• Problem: GET should only be used for read-only
(= idempotent and safe) requests.
What happens if you bookmark one of those links?
• Limitation: Requests can only send up to approx. 4KB of data
(414 Request-URI Too Long)
©2009-2010 - Cesare Pautasso - 30.6.2010 36

37. HTTP as a tunnel
 Tunnel through one HTTP Method
 Everything through POST
• Advantage: Can upload/download an arbitrary amount of data
(this is what SOAP or XML-RPC do)
• Problem: POST is not idempotent and is unsafe (cannot cache
and should only be used for “dangerous” requests)
POST /service/endpoint
<soap:Envelope>
<soap:Body>
<findCustomers>
<name>Pautasso*</name>
</findCustomers>
</soap:Body>
</soap:Envelope>
©2009-2010 - Cesare Pautasso - 30.6.2010 37

38. Outline
1. Introduction
to RESTful Web Services
2. Comparing REST and WS-*
©2009-2010 - Cesare Pautasso - 30.6.2010 38

39. Can we really compare?
WS-* REST
©2009-2010 - Cesare Pautasso - 30.6.2010 39

40. Can we really compare?
WS-* REST
Middleware Architectural
Interoperability style for
Standards the Web
©2009-2010 - Cesare Pautasso - 30.6.2010 40

41. How to compare?
REST
WS-* Architectural
style for
Middleware the Web
Interoperability
Standards
©2009-2010 - Cesare Pautasso - 30.6.2010 41

42. Architectural Decisions
 Architectural decisions Architectural Decision:
capture the main design Programming Language
issues and the rationale
behind a chosen Architecture Alternatives:
technical solution 1. Java
 The choice between 2. C#
REST vs. WS-* is an 3. C++
important architectural 4. C
decision for 5. Eiffel
Web service design 6. Ruby
7. …
 Architectural decisions
affect one another Rationale
©2009-2010 - Cesare Pautasso - 30.6.2010 42

43. Decision Space Overview
©2009-2010 - Cesare Pautasso - 30.6.2010 43

44. Decision Space Overview
21 Decisions and 64 alternatives
Classified by level of abstraction:
• 3 Architectural Principles
• 9 Conceptual Decisions
• 9 Technology-level Decisions
Decisions help us to measure the
complexity implied by the choice of
REST or WS-*
©2009-2010 - Cesare Pautasso - 30.6.2010 44

45. Comparison Overview
1. Protocol Layering
• HTTP = Application-level Protocol (REST)
• HTTP = Transport-level Protocol (WS-*)
2. Loose Coupling
3. Dealing with Heterogeneity
4. What about X?
5. (X = Composition)
6. Software Connectors for Integration
©2009-2010 - Cesare Pautasso - 30.6.2010 45

46. RESTful Web Service Example
Web Server
HTTP Client Database
Application Server
(Web Browser)
SELECT *
GET /book?ISBN=222 FROM books
WHERE isbn=222
POST /order INSERT
INTO orders
301 Location: /order/612
PUT /order/612 UPDATE orders
WHERE id=612
©2009-2010 - Cesare Pautasso - 30.6.2010 46

47. WS-* Service Example
(from REST perspective)
Web Server Web Service
HTTP Client
Application Server Implementation
(Stub Object)
POST /soap/endpoint
return getBook(222)
POST /soap/endpoint
return new Order()
POST /soap/endpoint
order.setCustomer(x)
©2009-2010 - Cesare Pautasso - 30.6.2010 47

48. Protocol Layering
“The Web is the universe of “The Web is the universal
globally accessible information” (tunneling) transport for
(Tim Berners Lee) messages”
 Applications should publish  Applications get a chance
their data on the Web to interact but they remain
(through URI) “outside of the Web”
AtomPub JSON POX … SOAP (WS-*)
HTTP HTTP HTTP HTTP HTTP
SMTP MQ…
GET POST PUT DEL POST
(Many) Resource URI 1 Endpoint URI
Application Application
©2009-2010 - Cesare Pautasso - 30.6.2010 48

49. Coupling Facets
Facets REST WS-*
 Discovery  Referral  Centralized
 Identification  Global  Context-Based
 Binding  Late  Late
 Platform  Independent  Independent
 Interaction  Asynchronous  Asynchronous
 Model  Self-Describing  Shared Model
 State  Stateless  Stateless
 Generated Code  None/Dynamic  Static
 Conversation  Reflective  Explicit
More Info on http://dret.net/netdret/docs/loosely-coupled-www2009/
©2009-2010 - Cesare Pautasso - 30.6.2010 49

50. Coupling Comparison
©2009-2010 - Cesare Pautasso - 30.6.2010 50

51. Dealing with Heterogeneity
 Enable Cooperation  Enable Integration
 Web Applications  Enterprise Architectures
Picture from Eric Newcomer, IONA
HTTP
CICS
IMS
©2009-2010 - Cesare Pautasso - 30.6.2010 51

52. Heterogeneity
Web Enterprise
Applications Architectures
REST WS-*
©2009-2010 - Cesare Pautasso - 30.6.2010 52

53. Heterogeneity
Web Enterprise
Applications Architectures
REST
Claim: REST can also be successfully used
to design integrated enterprise applications
©2009-2010 - Cesare Pautasso - 30.6.2010 53

54. Enterprise “Use Cases”
Enterprise
Architectures
CRUD Services
Web-friendly APIs
Mobile Services Real-time Services
Transactional Services
Composite Services
©2009-2010 - Cesare Pautasso - 30.6.2010 54

55. Enterprise “Use Cases”
Enterprise
Architectures
WS-*
REST
Part of the debate is about how many
“enterprise” use cases can be covered with
REST as opposed to WS-*
©2009-2010 - Cesare Pautasso - 30.6.2010 55

56. What about…
 Service Description
 Security
 Asynch Messaging
 Reliable Messaging
 Stateful Services
 Service Composition
 Transactions
 Semantics
 SLAs
 Governance
 …
©2009-2010 - Cesare Pautasso - 30.6.2010 56

57. What about service description?
 REST relies on human  Client stubs can be built from
readable documentation that WSDL descriptions in most
defines requests URIs programming languages
templates and responses  Strong typing
(XML, JSON media types)  Each service publishes its
 Interacting with the service own interface with different
means hours of testing and semantics
debugging URIs manually  WSDL 1.1 (entire port type
built as parameter can be bound to HTTP GET or
combinations. (Is is it really HTTP POST or SOAP/HTTP
that simpler building URIs by POST or other protocols)
hand?)
 Why do we need strongly  WSDL 2.0 (more flexible,
typed SOAP messages if both each operation can choose
sides already agree on the whether to use GET or POST)
content? provides a new HTTP binding
 WADL proposed Nov. 2006
 XForms enough?
©2009-2010 - Cesare Pautasso - 30.6.2010 57

58. What about security?
 REST security is all about  SOAP security extensions
HTTPS (HTTP + SSL/TLS) defined by WS-Security
(from 2004)
 Proven track record
(SSL1.0 from 1994)  XML Encryption (2002)
 HTTP Basic Authentication  XML Signature (2001)
(RFC 2617, 1999
RFC 1945, 1996)
 Note: These are also
applicable with REST when
using XML content
 Secure, end-to-end
 Secure, point to point communication – Self-
communication protecting SOAP messages
(Authentication, Integrity (does not require HTTPS)
and Encryption)
©2009-2010 - Cesare Pautasso - 30.6.2010 58

59. What about asynchronous
messaging?
 SOAP messages can be
 Although HTTP is a transferred using
synchronous protocol, asynchronous transport
it can be used to “simulate” a protocols and APIs
message queue. (like JMS, MQ, …)
 WS-Addressing can be used
POST /queue to define transport-
independent endpoint
202 Accepted references
Location:  WS-ReliableExchange defines
/queue/message/1230213 a protocol for reliable
message delivery based on
GET /queue/message/1230213 SOAP headers for message
identification and
DELETE /queue/message/1230213 acknowledgement
©2009-2010 - Cesare Pautasso - 30.6.2010 59

60. Blocking or Non-Blocking?
 HTTP is a synchronous interaction protocol.
However, it does not need to be blocking.
/slow
 A Long running request
may time out.
POST /slow  The server may answer it
with 202 Accepted
providing a URI from which
202 Accepted
the response can be
Location: x
retrieved later.
 Problem: how often should
GET /slow/x
the client do the polling?
/slow/x could include an
200 OK
estimate of the finishing
204 No Content
time if not yet completed
©2009-2010 - Cesare Pautasso - 30.6.2010 60

61. What about reliable
messaging?
 WS-ReliableMessaging
 The HTTP uniform interface (or WS-Reliability) define a
defines clear exception protocol for reliable message
handling semantics delivery based on SOAP
 If a failure occurs it is enough headers for message
to retry idempotent methods identification and
(GET, PUT, DELETE) acknowledgement
 With POST, recovery requires  WS-* middleware can ensure
an additional reconciliation guaranteed in-order, exactly
step (usually done with GET) once message delivery
before the request can be semantics
retried
 POE (POST-Once-Exactly) has  Hint: Reliable Messaging
been proposed to also make does not imply reliable
POST reliable applications!
©2009-2010 - Cesare Pautasso - 30.6.2010 61

62. What about stateful services?
 REST provides explicit state  SOAP services have implicit state
transitions transitions
 Communication is stateless*  Servers may maintain
conversation state across
 Resources contain data and multiple message exchanges
hyperlinks representing valid  Messages contain only data
state transitions (but do not include information
 Clients maintain application about valid state transitions)
state correctly by navigating  Clients maintain state by guessing
hyperlinks the state machine of the service
 Techniques for adding session to  Techniques for adding session to
HTTP: SOAP:
 Session Headers
 Cookies (HTTP Headers) (non standard)
 URI Re-writing  WS-Resource Framework
 Hidden Form Fields (HTTP on top of SOAP on top of
HTTP)
(*) Each client request to the server must contain all information needed to understand the request, without referring to any
stored context on the server. Of course the server stores the state of its resources, shared by all clients.
©2009-2010 - Cesare Pautasso - 30.6.2010 62

63. What about composition?
 The basic REST design  WS-BPEL is the standard
elements do not take Web service composition
language. Business process
composition into account models are used to specify
how a collection of services
HTTP is orchestrated into a
composite service
User Agent Origin Server  Can we apply WS-BPEL to
RESTful services?
HTTP Origin Server
User Agent ?
Origin Server
©2009-2010 - Cesare Pautasso - 30.6.2010 63

64. REST Scalability
Cache
Proxy/Gateway
Origin
Client
Clients Server
 One example of REST middleware is to help
with the scalability of a server, which may
need to service a very large number of
clients
©2010 - Cesare Pautasso 64

65. REST Scalability
Cache
Proxy/Gateway Origin
Server
Clients
 One example of REST middleware is to help
with the scalability of a server, which may
need to service a very large number of
clients
©2010 - Cesare Pautasso 65

66. REST Composition
Proxy/Gateway Origin
Server
Clients
 Composition shifts the attention to the client
which should consume and aggregate from
many servers
©2010 - Cesare Pautasso 66

67. REST Composition
Client Composite Origin
RESTful Servers
service
 The “proxy” intermediate element which
aggregates the resources provided by
multiple servers plays the role of a
composite RESTful service
 Can/Should we implement it with BPM?
©2010 - Cesare Pautasso 67

68. Composite Resources
DELETE
PUT
GET
C
DELETE DELETE
POST PUT PUT
GET
R GET
S
POST POST
©2010 - Cesare Pautasso 68

69. Composite Resources
 The composite resource only aggregates the
state of its component resources
C
R S
State R State S
©2010 - Cesare Pautasso 69

70. Composite Resources
 The composite resource augments (or caches)
the state of its component resources
C State C
R S
State R State S
©2010 - Cesare Pautasso 70

71. Composite Representation
DELETE
PUT
DELETE
Composite GET
R PUT
Representation
POST
S
C
GET
POST
LinkR
LinkS
©2010 - Cesare Pautasso 71

72. Composite Representation
Composite
Representation
Origin
Server
Client Origin
Servers
 A composite representation is interpreted by
the client that follows its hyperlinks and
aggregates the state of the referenced
component resources
©2010 - Cesare Pautasso 72

73. Bringing it all together
Composite
Representation
Composite Origin
RESTful Servers
service
Client Origin
Servers
 A composite representation can be
produced by a composite service too
©2010 - Cesare Pautasso 73

74. Doodle Map Example
Composite
Representation
Composite Origin
RESTful Servers
service
Client Origin
Servers
 Vote on a meeting place based on its
geographic location
©2010 - Cesare Pautasso 74

75. Composite Resource
DELETE
PUT
GET
C
DELETE DELETE
POST PUT PUT
GET
R GET
S
POST POST
©2010 - Cesare Pautasso 75

76. Composite Resource
DELETE
GET
C
DELETE
POST PUT
GET
R GET
S
POST
©2010 - Cesare Pautasso 76

77. Composite Representation
DM DELETE
GET
G
LinkG
GET
C
LinkC DELETE
POST PUT
LinkD
GET
R GET
S
POST
©2010 - Cesare Pautasso 77

78. Demo
©2009-2010 - Cesare Pautasso - 30.6.2010 78

79. Doodle Map Architecture
Web Browser Workflow RESTful
Engine Web Services
RESTful API
APIs
GET
POST
GET
Watch it on http://www.jopera.org/docs/videos/doodlemap
©2009-2010 - Cesare Pautasso - 30.6.2010 79

80. DoodleMap Model
©2010 - Cesare Pautasso 80

81. Viewpoints
Control Data
Flow Flow
Service
Bindings
JAVA XPATH XSLT HTML HTTP …
©2010 - Cesare Pautasso 81

82. Control
Flow
Control Flow
Dependency
©2010 - Cesare Pautasso 82

83. Service
Bindings
HTTP
HTML
XSLT
XPATH
JAVA
…
©2010 - Cesare Pautasso 83

84. Data
Flow
Data Flow
(Copy)
©2010 - Cesare Pautasso 84

85. Was it just a mashup?
Mashup
REST
Composition
(It depends on the definition of Mashup)
©2010 - Cesare Pautasso 85

86. Moving state around
 Read-only vs. Read/Write
DELETE
PUT
GET
C
DELETE DELETE
POST PUT PUT
GET
R GET
S
POST POST
©2010 - Cesare Pautasso 86

87. Simply aggregating data
 Read-only vs. Read/write
GET
C
GET
R GET
S
©2010 - Cesare Pautasso 87

88. Is your composition reusable?
 UI vs. API Composition
Composite
API
Representation
Composite Origin
RESTful Servers
UI
service
 Reusable
Client Origin services vs.
Servers Reusable
Widgets
©2010 - Cesare Pautasso 88

89. Single-Origin Sandbox
 Can you always do this
from a web browser?
Composite
Representation
Composite Origin
RESTful Servers
service
Client Origin
Servers
©2010 - Cesare Pautasso 89

90. Single-Origin Sandbox
 Security Policies on the client may not
always allow it to aggregate data from
multiple different sources
Composite
Representation
Composite N Origin
RESTful Servers
service
Client 1 Origin Server
 This will change very soon with HTML5
©2010 - Cesare Pautasso 90

91. Complementary
Read-Only
Read/Write
UI Mashup
REST API
Composition
Reusable
Situational Service
Sandboxed
©2010 - Cesare Pautasso 91

92. Towards REST Composition
 REST brings a new perspective and new problems to
service composition
 RESTful services can be composed on the server by
defining composite resources and on the client with
composite representations
 Composing RESTful services helps to put the
integration logic of a mashup into a reusable service
API and keep it separate from its UI made out of
reusable widgets
 Business processes can be published on the Web as
RESTful Services
 RESTful Web service composition is different than
mashups, but both can be built using BPM tools like
JOpera
 GET http://www.jopera.org/
©2010 - Cesare Pautasso 92

93. Software Connectors
File Transfer
Shared Data
Procedure Call
Remote Procedure Call
Message Bus
Events
©2010 - Cesare Pautasso 93

94. RPC
Call
Remote Procedure Call
• Procedure/Function Calls are the easiest to program with.
• They take a basic programming language construct and make it
available across the network (Remote Procedure Call) to connect
distributed components
• Remote calls are often used within the client/server architectural
style, but call-backs are also used in event-oriented styles for
notifications
©2010 - Cesare Pautasso 94

95. Hot Folder
Write
Copy File Transfer
(Hot Folder)
• Transferring files does not require
Watch to modify components
• A component writes a file, which is
Read
then copied on a different host,
and fed as input into a different
component
• The transfers can be batched with
a certain frequency
©2010 - Cesare Pautasso 95

96. Shared Database
Create
Read Shared Database
Update • Sharing a common database does not
require to modify components, if they all
can support the same schema
Delete • Components can communicate by
creating, updating and reading entries in
the database, which can safely handles
the concurrency
©2010 - Cesare Pautasso 96

97. Bus
Publish
Subscribe Message Bus
• A message bus connects a variable number of components, which
are decoupled from one another.
• Components act as message sources by publishing messages into
the bus; Components act as message sinks by subscribing to
message types (or properties based on the actual content)
• The bus can route, queue, buffer, transform and deliver messages to
one or more recipients
• The “enterprise” service bus is used to implement the SOA style
4.3.2010
©2010 - Cesare Pautasso 97

98. Different software connectors
RPC ESB
WS-*
WWW
REST
©2010 - Cesare Pautasso 98

99. Web (RESTful Web services)
Get Put
Delete
Post Web
• The Web is the connector used in the REST (Representational State
Transfer) architectural style
• Components may reliably transfer state among themselves using the
GET, PUT, DELETE primitives. POST is used for unsafe interactions.
Spring Semester 2010
Software Architecture and Design 99

100. Comparison Conclusion
 You should focus on whatever solution gets
the job done and try to avoid being religious
about any specific architectures or
technologies.
 WS-* has strengths and weaknesses and will
be highly suitable to some applications and
positively terrible for others.
 Likewise with REST.
 The decision of which to use depends entirely
on the application requirements and
constraints.
 We hope this comparison will help you make
the right choice.
©2009-2010 - Cesare Pautasso - 30.6.2010 100

101. References
 Roy Fielding, Architectural Styles and the Design of Network-based
Software Architectures, PhD Thesis, University of California, Irvine,
2000
 Leonard Richardson, Sam Ruby, RESTful Web Services, O’Reilly,
May 2007
 Jim Webber, Savas Parastatidis, Ian Robinson, REST in Practice:
Hypermedia and Systems Architecture, O‘Reilly, 2010
 Subbu Allamaraju, RESTful Web Services Cookbook: Solutions for
Improving Scalability and Simplicity, O’Reilly, 2010
 Stevan Tilkov, HTTP und REST, dpunkt Verlag, 2009,
http://rest-http.info/
©2009-2010 - Cesare Pautasso - 30.6.2010 101

102. Web References
 Martin Fowler,
Richardson Maturity Model: steps toward the glory of REST,
http://martinfowler.com/articles/richardsonMaturityModel.html
 My Constantly Updated Feed or REST-related material:
http://delicious.com/cesare.pautasso/rest
 This week in REST
http://thisweekinrest.wordpress.com/
©2009-2010 - Cesare Pautasso - 30.6.2010 102

103. Self-References
 Cesare Pautasso, Olaf Zimmermann, Frank Leymann,
RESTful Web Services vs. Big Web Services: Making the Right Architectural
Decision, Proc. of the 17th International World Wide Web Conference
(WWW2008), Bejing, China, April 2008.
 Cesare Pautasso and Erik Wilde. Why is the Web Loosely Coupled? A Multi-
Faceted Metric for Service Design, Proc of the 18th International World
Wide Web Conference (WWW2009), Madrid, Spain, April 2009.
 Cesare Pautasso, BPEL for REST, Proc. of the 6th International Conference
on Business Process Management (BPM 2008), Milan, Italy, September
2008.
 Cesare Pautasso, RESTful Web Service Composition with JOpera, Proc. Of
the International Conference on Software Composition (SC 2009), Zurich,
Switzerland, July 2009.
 Cesare Pautasso, Gustavo Alonso: From Web Service Composition to
Megaprogramming In: Proceedings of the 5th VLDB Workshop on
Technologies for E-Services (TES-04), Toronto, Canada, August 2004
 Thomas Erl, Raj Balasubramanians, Cesare Pautasso, Benjamin Carlyle,
SOA with REST, Prentice Hall, end of 2010
©2009-2010 - Cesare Pautasso - 30.6.2010 103

104. Leonard Richardson, Thomas Erl, Raj Balasubramanians,
Sam Ruby, Cesare Pautasso, Benjamin Carlyle,
RESTful Web Services, SOA with REST,
O’Reilly, May 2007 Prentice Hall, end of 2010
©2009-2010 - Cesare Pautasso - 30.6.2010 104

105. Abstract Submission: Friday, July
©2009-2010 - Cesare Pautasso - 30.6.2010
16, 2010 105