Web Development APIs and REST 5 — Questions and Answers
Question 1: What is the main advantage of using JSON Web Tokens (JWT) over server-side sessions?
- JWTs are always encrypted
- JWTs are stateless and can be verified without a database lookup (Correct answer)
- JWTs cannot be stolen or misused
- JWTs support larger payloads than session cookies
Correct answer: JWTs are stateless and can be verified without a database lookup
JWTs are self-contained tokens that encode claims, allowing servers to verify them without querying a session store, enabling stateless scalability.
Question 2: Which REST API design pattern uses a URL like '/users/{id}/orders' to represent relationships?
- Flat resource pattern
- Nested resource pattern (Correct answer)
- Linked resource pattern
- Embedded resource pattern
Correct answer: Nested resource pattern
Nested resources express parent-child relationships in the URL hierarchy, making it clear that orders belong to a specific user.
Question 3: What is the purpose of the 'X-Request-ID' header in API requests?
- To specify the API version being used
- To provide a unique identifier for tracing a request through distributed systems (Correct answer)
- To authenticate the requesting client
- To indicate the request priority level
Correct answer: To provide a unique identifier for tracing a request through distributed systems
X-Request-ID (or Correlation-ID) is a unique identifier added to requests to enable end-to-end tracing across multiple services in a distributed system.
Question 4: What is 'API throttling' designed to prevent?
- Unauthorized access to API endpoints
- A single client from monopolizing server resources with excessive requests (Correct answer)
- SQL injection attacks via API parameters
- Man-in-the-middle attacks on API traffic
Correct answer: A single client from monopolizing server resources with excessive requests
API throttling limits the request rate per client to ensure fair resource distribution and protect the server from overload.
Question 5: In REST API design, what is the recommended way to handle soft deletes?
- Use DELETE method and remove the record permanently
- Add a query parameter ?soft=true to the DELETE request
- Use PATCH to set a 'deleted_at' timestamp or 'status' field (Correct answer)
- Use a custom DELETE-SOFT HTTP method
Correct answer: Use PATCH to set a 'deleted_at' timestamp or 'status' field
Soft deletes are typically handled with PATCH to mark a resource as deleted (e.g., setting deleted_at or is_deleted) without removing it from the database.
Question 6: What does 'API backward compatibility' mean in practice?
- New API versions must support older HTTP protocols
- Adding new features without breaking existing client integrations (Correct answer)
- Clients must update their code with every API release
- The API must support all past request formats simultaneously forever
Correct answer: Adding new features without breaking existing client integrations
Backward compatibility means existing clients continue to work correctly after API updates, typically by only adding (not removing or renaming) fields and endpoints.
Question 7: Which of the following is a characteristic of a RESTful API's uniform interface?
- All endpoints must return JSON
- Resources are identified by URIs and manipulated through standard HTTP methods (Correct answer)
- All clients must use the same programming language
- The API must use TLS 1.3 or higher
Correct answer: Resources are identified by URIs and manipulated through standard HTTP methods
REST's uniform interface constraint requires that resources be identified via URIs and that standard HTTP methods (GET, POST, PUT, DELETE) define operations on them.
Web Development APIs and REST 5
What is the main advantage of using JSON Web Tokens (JWT) over server-side sessions?