web Servics

Secure Web Application Development

Joshua Mcshannon

University of Nebraska at Omaha

CYBR 8470 

Today: Web Services

Part 0: Stress Tests and Scaling Woes

  • Discuss latest MATRIX stress test
  • The importance of failure
  • Postmortem Review

Part 1: Service-oriented Architectures (SOA)

  • History and SOA introduction
  • Service actors
  • Modularization and Service orientedness (to microservices)
  • Types of services

Part 2: Service Oriented Methods and Data formats

  • WSDL, SOAP, and WS-* standards
  • REST and JSONAPI standard
  • GraphQL
  • Web sockets
  • Data Formats: XML, JSON

Part 3: Building Services in Django (lab)

Part 0: StresS Tests And Scaling Woes

What is a Stress Test

  • Intentionally placing higher than average load on an entity. This helps to understand the performance of whatever is being stress tested under heavy load conditions.

What is Scaling

Scaling is a process for increasing the capacity of a system to address growing needs and resource constraints and generally has two flavors

 

  • Horizontal Scaling - Add more servers
  • Vertical Scaling - Add more resources

The importance Of Failure

  • Experience
  • Resiliency
  • Improvement

PostMORTEM Review

  • Blameless culture
  • Purpose
  • Structure
    • Date
    • RCA
    • Trigger
    • Resolution
    • Detection
    • AI (Action Items)
    • LL
      • What went well
      • What went poorly
      • Where we got lucky
    • Timeline

Part1: Service-Oriented Architectures

History and SOA introduction

What Is a Service?

Real world 'service':

  • A piece of work performed by a service provider

  • Takes some input and produces some desired results

    • e.g. a restaurant: pay some money and get some food

    • e.g. a roofing company: pay some money, get a roof repair

  • Has quality characteristics (price, time, goodness of product, etc.)

Software world 'service':

  • Takes some input, performs some work, produces some output
  • Request-response model: client requests, server responds
  • Has quality characteristics (price, execution time, availability, security,  goodness of product, etc.)

Definition

A "web service" is a piece of software that performs processing and uses a web protocol to accept requests and issue responses.


earlier...

 

web service: a piece of software that serves up data through a web interface. Typically web services are object-oriented, provide access to a database, and encode data in XML or JSON.

Definition

SOA (Service-Oriented-Architecture) is an architectural paradigm that modularizes business functions into services by decoupling and encapsulating different portions of the business logic into different service components.

  • Services in SOA:
    • are autonomous and stateless
    • accept requests and return responses
    • use well-defined, standard interfaces (standard protocols) that define inputs and output structures
    • platform independent
    • discoverable

Autonomous -> Need not be aware of other services

stateless -> need not remember state from request to request

 

  • Improves scalability through horizontal cloning
  • Can store state in a database if it needs to be saved

standard interfaces -> Re-use web stack and define custom application endpoints

credit:

Torsten Braun, Universität Bern

platform independent -> Write a service once, support many platforms

discoverability

Service Actors

Services need consumers. Consumers use a client to make requests to the service's server. They expect to get a desired result or an error message.

 

Service providers host and manage their service offerings - maintaining service quality and security.

 

Service brokers match service consumers and providers - sometimes composing multiple services to fulfill consumer needs.

 

Modularization and Service orientedness

Modularization Through Service-orientedNess

Will come back to this

img credit: http://usblogs.pwc.com/emerging-technology/agile-coding-in-enterprise-it-code-small-and-local/

Service Types

  1. Infrastructure as a service (IaaS)
  2. Platform as a service (PaaS)
  3. Software as a service (SaaS)
  4. Desktop as a service (DaaS)
  5. Service as a service (SaaS2)

 

 

Example

credit: https://m.oursky.com/saas-paas-and-iaas-explained-in-one-graphic-d56c3e6f4606

Part2: Service Oriented Methods/protocols 
and Data formats

A Tale of Two Eras

Legacy Services:

  • Uses SOAP, WSDL, XML, WS-*, etc

  • Older, more formally specified service types

Modern Services:

  • RESTful API services:
    • Uses HTTP, REST, JSON
    • Most pervasive services circa 2020
  • "Streaming" services:
    • Uses websockets
    • real time applications with "server push"
      usecases
  • New age services:
    • ​graphQL
    • gRPC (google Remote procedure call)

 

SOAP ERA

RESTful ERA

Elements of a "Legacy" Service

Description in terms of WSDL (Web Service Definition Language):

  • Describes what a web service can do
  • WSDL is an XML based, open standard from W3C
  • Declares available methods (endpoints)
  • Identifies Input and output parameters

Protocol uses SOAP to exchange XML, XSD on top of HTTP

  • SOAP (Simple Object Access Protocol)

  • XML (Extensible Markup Language)

  • XSD (Extensible Schema Definition)

HTTP

Example WSDL

SOAP

Simple Object Access Protocol

  • Encapsulated in an Envelope
  • SOAP Header
  • SOAP Body
  • operates over HTTP or TCP
  • Allows for requests and responses
  • fill in parameters according to WSDL

 

SOAP Request Example

Note: Refers to some function called 'CalcDistance' that has two parameters 'startPoint' and 'endpoint'. Each point has an x and y field in the object.

SOAP ReSponse Example

Modern Services

REST

  • Representational State Transfer
  • Associate every resource with a URI (Universal Resource identifier) - accessible from a URL
  • Allow CRUD operations to retrieve and persist data -> works really well with SOA
  • We've seen REST at work with services like Twitter
  • REST has lots of advantages of most other approaches, but can result in overfetching or underfetching

graphQL

  • Basic idea: Traverse a graph to get only the data you need
  • Solves the problem of underfetching or overfetching
  • Invented by facebook
  • downside:
    • complicates architectural design (harder to use micro services)
    • very difficult to cache, since all requests are unique

WebSockets

  • Works directly on a single TCP connection
  • Provides full duplexing (bi-directional) communication between server and client - remains open during the duration of the connection
  • Great for streaming applications that rely upon a rapidly updating publish/subscribe model - particularly for server pushes 

DATA Formats

XML

  • XML is a markup-language for data representation
  • Used for encoding documents in machine-readable form
  • Text-based format, consists of tags, attributes and content
  • Can be used for data, meta-data, and structural presentation

JSON

  • JavaScript Object Notation
  • Basically a set of key:value pairs that define data according to a dictionary structure. 
  • Typically much less verbose than XML
    • e.g. <somedatatype>somedatavalue</somedatatype> becomes { "somedatatype": somedatavalue}.
    • particularly true for nested structures
  • Used for data structures not page or document structuring
  • Can still include meta-data easily.

RPC/graphs/etc

  • Remote procedure calls have been around for a long time. Depending on the RPC framework used, there are variant semantics. 
  • Graphs are data representations of actual networks of connected objects. Data is often serialized into a JSON format, but may be held in a variety of different formats.

Part3: Web Services (In Django) Lab

Questions?

Joshua Mcshannon

University of Nebraska at Omaha

Adjunct , Cybersecurity

MATRIX Engineer

 

jmcshannon@unomaha.edu

Attribution: Some slides are based on material from:

"Web services, SOA, and REST" course by the SoftUNI Foundation and are used under the CC-BY-NC-SA license

CYBR 8470 Web Services

By jmcshannon

CYBR 8470 Web Services

  • 26