MuleSoft Blog

This is all second-hand and probably wrong, but I worked for MuleSoft shortly after McDonalds began to pull the plug on them after they experienced two regional outages. The outage was a matter of minutes, not hours, but payments weren’t affected. It only affected, as far as I know, kiosks - this was before they were everywhere. I can imagine this will cost a few heads at McDonalds who didn’t have a DRP or BCP which included secondary payment infrastructure. Even if you were paying double retail rates and ate the cost for your franchisees, it would have been worth it. For a company so dependent on external vendors, I’m surprised we don’t see more outages. I was always surprised to hear they outsourced their integration infrastructure for the core business. I’m sure it’s like that elsewhere given the number of customer stories floating around for McDonalds. They have the capital, brand, network and infrastructure to be a tech powerhouse. But they’re…

While experts are present (and since the notes on security in the readme are refreshing), I'd like to ask a general question about securing OAuth 2 tokens. My use case is to have a server that uses the explicit OAuth flow (redeeming a code obtained from the user in order to get permission to operate on the user’s behalf) but also have a front end client that uses the implicit flow (retrieving an access token for direct use) to make requests from the browser or mobile device. That way the user can surf freely and only hit the server when it needs to save something (which allows the app to scale). The problem is that I don't want the user to have to authenticate twice. Ideally the user should be able to OK the standard OAuth web page to obtain a front end token AND also visit the server callback url with a redemption code. However I can’t find a single social provider that does this! I scoured the web and Stack Overflow and can’t find a good discussion about the security of sharing tokens (all they say is to pass it over SSL). So the best I could come up with is to authenticate implicitly on the front end and pass the client access token to the server. This seems safer to me than sharing the explicit access token from the server to the client in the outside world. Token sharing from client to server presents several security issues, because the server has to trust that the token belongs to the current user. It completely negates ever using the explicit flow, because…

Mulesoft have been moving away from RAML I believe, although it is still petty core to their product. https://blogs.mulesoft.com/dev/api-dev/open-api-raml-better-together/

>Netflix's web site (not the playout system) was originally a bunch of Python programs. seems that the bunch has grown slightly since then: https://cdn-images-1.medium.com/max/600/1*OhONoCsb1KvesLy-n5ZsSw.png (from https://medium.com/netflix-techblog/announcing-ribbon-tying-the-netfli… ) Or this view https://image.slidesharecdn.com/devopsisraelpdf-141030000609-conversio… (from https://blogs.mulesoft.com/dev/microservices-dev/api-approach-to-micro… )

Actually, there is a simple and good way to think about this. We often espouse the "onion model of applications" describing the responsibilities of different layers of applications. Just apply that here - some API endpoints should be backend "system APIs" offering as much access to entities as possible - think "data layer APIs". When you want to expose data to consumers for use in a UI, these are "experience APIs". These are APIs that might be built as part of the backend that directly interacts with the frontend. Mulesoft talks about this a lot [1]. I am a user of it at work, not necessarily a big fan, but I think their architecture idea is applicable anywhere and helpful for thinking about layers of APIs in a large system. It's similar to the onion model, just applied to APIs. Now, if you are building a smaller system this might all seem overkill. For a small system it might be true, unless you believe it will scale and need to be architected like this from the beginning. I think scale of the end result should always be factored into architecture decisions, because not one size fits all. I think personally there is a model out there that hasn't been expressed fully/fully realized, that integrates ideas of APIs, GraphQL, CQRS, microservices and the onion model. [1] https://blogs.mulesoft.com/dev/api-dev/what-is-api-led-connectivity/