Hacker News Reader

Comment by DrFell | Hacker News Reader

Intercommunicating backend services isn't new, but having an HTTP API call another one from the backend is a case that used to be more normally accomplished by calling both APIs from the frontend. The slow ooze of browser-oriented thinking onto the backend took time. Existing backend engineers, who thought it a harebrained scheme, had to eventually wear down, and give up.

View on HN

So when you write an application that integrates with an external service via an HTTP API, you think the normal way to architect such an application is to make all API requests from the browser? And you think that making such calls from the backend is a new and "harebrained" idea that backend devs have been forced to adopt against their better judgement?

I'm curious to know what position you occupy in our industry?

Yes, I think the normal way to integrate an app with an HTTP API is via the browser.

Calling an external API from a backend that integrates directly with an client app has been rare for me. Payment processing is all that comes to mind, and that was usually through an imported API package. I've made data scraping tools, but they were unique projects, not part of an app backend. I am a senior full-stack webdev.

Has it ever occurred to you that your users can (a) see all requests you make to third party services, including your credentials and client secrets, (b) modify and replay those requests at will and (c) spoof responses from those services?

I think the misunderstanding is, beyond special cases like a payment processing, why would you be calling third party services from your service? When I think of calling a 3rd party HTTP API, I am thinking of public APIs, like say a widget that shows the weather in a users area.

I'm going to take a wild stab in the dark here and guess that despite having the title "senior", you have little or no experience in commercial software development? Because what you dismiss as "special cases" covers a vast amount of the plumbing of the modern web. In modern apps even something as simple as storing and retrieving files requires HTTP calls at some point in the stack, and such calls should never under any circumstances be initiated from someone else's computer.

Which brings us back to the original question you responded to above. Contrary to your odd views of how software is architected, issuing HTTP requests from the backend is both normal and common enough to be banal. Node adopting the fetch API is generally a good thing as it allows JS developers to code against the same interface whether they are working from the frontend or the backend.

Sure - but that weather/map/whatever widget might be paid, and unless you want to pay for others' API usage, you should make the relevant API calls from your backend, not frontend. Also consider caching 3rd party service replies, etc.

Reply on news.ycombinator.com