- SCA vs. SOA?
- Supporting SCA’s Java Component Model: Which Vendo...
- Microsoft and BPM: A Technology Overview
- Introducing System Center
- Windows Workflow Foundation and BPEL
- Blog Tag: My Turn
- What's Really Important About SCA
- Quantifying Complexity: .NET vs. J2EE
- The Changing Definition of a BPM Vendor: Does Micr...
- More Responses to SOA and the Reality of Reuse
Opinari
Subscribe
REST vs. WS-*: War is Over (If You Want It)
# Wednesday, June 27, 2007
To anybody who's paying attention and who's not a hopeless partisan, the war between REST and WS-* is over. The war ended in a truce rather than crushing victory for one side--it's Korea, not World War II. The now-obvious truth is that both technologies have value, and both will be used going forward.
If you doubt this, take a look at Microsoft's forthcoming support for creating RESTful applications in the next release of Windows Communication Foundation (WCF). The official Java world is also on board, with the impending creation of JAX-RS. Since both worlds also have good support for the WS-* approach, developers will be able to choose the approach that's best for a particular application.
Two big questions remain. The first is, What exactly is REST? By far the best and clearest definition I've seen is provided by RESTful Web Services, a wonderful book by Leonard Richardson and Sam Ruby. If everybody can buy into the measures of RESTfulness this book provides, we can all avoid lots of future arguments. (As a side benefit, it will let most of us get by without reading Roy Fielding's PhD thesis, the canonical text on REST.)
The second question is, When should each approach be used? Whatever partisans may claim, neither technology is right for every situation. While hammering out a true understanding of this will likely take some time, the basic outlines are clear. A RESTful approach is a natural for data-oriented applications that focus on create/read/update/delete scenarios. Lots and lots of apps fit this model, especially on the public Internet. A solution based on WS-* makes more sense for service/method-oriented applications, especially those that need more advanced behaviors such as transactions and more-than-basic security. (Doubt this last point? Look up "Security" in the index of the Richardson/Ruby book: Exactly one page number is listed.)
Maybe the problem was always really just naming. Applying the term "Web services" to SOAP/WS-* applications doesn't make much sense. The SOAP/WS-* stack is actually the culmination of a twenty-year vendor battle over distributed computing protocols, the end of a line that included OSF DCE, CORBA, DCOM, Java RMI, and .NET Remoting. By finally agreeing on this standard set of technologies, the vendors have put an end to their long struggle. Yet other than the fact that SOAP is commonly sent over HTTP to get through firewalls, these technologies have nothing to do with the Web. REST, on the other hand, is deeply Web-based--it's just a way to create distributed applications using standard Web technologies. Given this, REST is far more deserving of the "Web services" moniker than is the SOAP/WS-* approach.
I've always thought REST was interesting, starting with the first piece I wrote on it almost five years ago. I've also been a fan of SOAP and WS-*, partly because I've spent a large part of my career on that vendor battlefield. It's a real pleasure to see fanaticism recede and reason win the day. The war really is over.
15 comments :: Post a Comment
Comments:
I agree. REST is great for data-centric applications, but nobody has been able to tell me how to use REST to create a web service providing secure transactions. One of the goals of web services back in 2002 was to provide self-describing and discoverable web services. How does REST meet these criteria? You're very right when you claim that REST and Web services are two different solutions for different problems and that both will continue to exist.
# posted by 
: July 07, 2007 2:01 AM
: July 07, 2007 2:01 AM
David,
Nice blog (as always)! One comment-
I am not sure I agree with your characterization that the war is over. Yes, there is now increasing evidence of support for both of these technologies in different vendor products. But what does that really mean? Perhaps the vendors are themselves tired of the long debate and are now asking the customers to decide (right thing to do!).
Like you and many others, I always thought that both of these technologies have their own strengths and purposes in life. I believe what made it confusing for all of us was the idea of forcing a single model for all things Internet (or Web whatever you want to call). So by making both these technologies available for actual use in the mainstream, the war may not be over but the battleground may have shifted from the realms of partly philosophical arguments to the actual realities of the world, where customer choice decides the final fate of any technology - may be one of these will die, may be both will survive in their own domains. We will see ...
-- Sanjay
SAP Labs, Palo Alto
Nice blog (as always)! One comment-
I am not sure I agree with your characterization that the war is over. Yes, there is now increasing evidence of support for both of these technologies in different vendor products. But what does that really mean? Perhaps the vendors are themselves tired of the long debate and are now asking the customers to decide (right thing to do!).
Like you and many others, I always thought that both of these technologies have their own strengths and purposes in life. I believe what made it confusing for all of us was the idea of forcing a single model for all things Internet (or Web whatever you want to call). So by making both these technologies available for actual use in the mainstream, the war may not be over but the battleground may have shifted from the realms of partly philosophical arguments to the actual realities of the world, where customer choice decides the final fate of any technology - may be one of these will die, may be both will survive in their own domains. We will see ...
-- Sanjay
SAP Labs, Palo Alto
# posted by : July 08, 2007 9:28 AM
: July 08, 2007 9:28 AM
This is a good point, Sanjay. Maybe it's more accurate to say that the ideological war is ending, clearing the way for a pragmatic competition between the two technologies.
Who knows? Perhaps we'll find that the areas for which each approach is appropriate are largely disjoint, and so there isn't much competition at all. In any case, I agree with you that letting customers decide is the right thing to do--I'm glad we'll all have this opportunity.
Who knows? Perhaps we'll find that the areas for which each approach is appropriate are largely disjoint, and so there isn't much competition at all. In any case, I agree with you that letting customers decide is the right thing to do--I'm glad we'll all have this opportunity.
"but nobody has been able to tell me how to use REST to create a web service providing secure transactions."
When you purchase things on the internet and that little secure icon appears in your browser indicating that you are on an https connection, that's a secure transaction...that post that you perform by clicking "submit" can also be done by a computer. And there you have it...a RESTfull secure transaction.
I'd put this question back to you and Chappell. What is this amazing security mechanism that WS- has that cannot be applied to REST?
Taylor
When you purchase things on the internet and that little secure icon appears in your browser indicating that you are on an https connection, that's a secure transaction...that post that you perform by clicking "submit" can also be done by a computer. And there you have it...a RESTfull secure transaction.
I'd put this question back to you and Chappell. What is this amazing security mechanism that WS- has that cannot be applied to REST?
Taylor
# posted by : July 10, 2007 8:48 AM
: July 10, 2007 8:48 AM
WS- security provides actual message security, not simply transport security.
For point-to-point operations, simple transport security may well be enough. And, of course, WS- handles that just like REST does. But going the extra mile to add message security (encryption and/or message signatures) is where the WS- stuff kicks in.
Nothing says any of this can't be done with REST, of course, the detail is, well, the details. WS- strives for interoperability (the large effort between Sun and MS for instance). The goal is that by adhering to the WS- standards, when you want message security for a web service, the standards dictate the details, rather than a conversation with the service provider.
I've read the book mentioned in the post, and it's a great book. I think it communicates the REST meme quite well.
And I think for the public consumption that happens in the Wild of the Internet, REST is spectacular. It works, and it's easy to use. I'm a big fan, and will use it more in my apps.
WS- services layer a boat load of functionality above and beyond "CRUD", and most of this is driven by the complicated system sitting behind the corporate firewalls.
If you will recall, SOAP has a lineage pointing straight back to XML-RPC, which is a pretty simple protocol. But look where it is today. People aren't adding these layers to SOAP via the WS-* mechanism for fun (or profit, despite the conspiracy theories). They're driven by need.
My fear is that as REST matures, the feature creep that has affected SOAP and WS-* today will creep in to REST. But REST doesn't have the consortium behind it to keep things sane that SOAP and WS-* has.
So, we may well end up with Franken-REST, or even worse, end up with a time where "We use REST" doesn't mean anything at all.
With SOAP and WS-* you know going in that there's a zillion lines of spec and such involved. REST is impressed upon as being simple. What happens when that's no longer the case?
For point-to-point operations, simple transport security may well be enough. And, of course, WS- handles that just like REST does. But going the extra mile to add message security (encryption and/or message signatures) is where the WS- stuff kicks in.
Nothing says any of this can't be done with REST, of course, the detail is, well, the details. WS- strives for interoperability (the large effort between Sun and MS for instance). The goal is that by adhering to the WS- standards, when you want message security for a web service, the standards dictate the details, rather than a conversation with the service provider.
I've read the book mentioned in the post, and it's a great book. I think it communicates the REST meme quite well.
And I think for the public consumption that happens in the Wild of the Internet, REST is spectacular. It works, and it's easy to use. I'm a big fan, and will use it more in my apps.
WS- services layer a boat load of functionality above and beyond "CRUD", and most of this is driven by the complicated system sitting behind the corporate firewalls.
If you will recall, SOAP has a lineage pointing straight back to XML-RPC, which is a pretty simple protocol. But look where it is today. People aren't adding these layers to SOAP via the WS-* mechanism for fun (or profit, despite the conspiracy theories). They're driven by need.
My fear is that as REST matures, the feature creep that has affected SOAP and WS-* today will creep in to REST. But REST doesn't have the consortium behind it to keep things sane that SOAP and WS-* has.
So, we may well end up with Franken-REST, or even worse, end up with a time where "We use REST" doesn't mean anything at all.
With SOAP and WS-* you know going in that there's a zillion lines of spec and such involved. REST is impressed upon as being simple. What happens when that's no longer the case?
# posted by : July 10, 2007 6:09 PM
: July 10, 2007 6:09 PM
Security in the WS-* world certainly can be message-oriented, as the previous comment points out, and this can be useful. Yet there's lots more.
For example, suppose you want to send a security token other than username/password, maybe even allowing it to be passed to another service. WS-Security defines a standard way to send SAML assertions, Kerberos tickets, X.509 certificates, and more. And maybe you decide that it would be useful to have a standard way to acquire these security tokens, one that everybody supports in the same way. WS-Trust defines a protocol for doing exactly this. And what about providing efficient encrypted communication when SSL isn't a viable option, e.g., inside most corporations? WS-SecureConversation defines a standard way to do this. (For an overview of these technologies, you might take a look at http://msdn.microsoft.com/msdnmag/issues/03/04/ws-security/default.aspx#S8.)
It would be possible to define all of these things for a RESTful world, of course. But when you were done, you'd have something much like WS-Security and friends.
There are lots of situations where the relatively simple world of the Internet just doesn't apply. Because it defines things such as more capable security, WS-* will often be the right choice for cases like these.
For example, suppose you want to send a security token other than username/password, maybe even allowing it to be passed to another service. WS-Security defines a standard way to send SAML assertions, Kerberos tickets, X.509 certificates, and more. And maybe you decide that it would be useful to have a standard way to acquire these security tokens, one that everybody supports in the same way. WS-Trust defines a protocol for doing exactly this. And what about providing efficient encrypted communication when SSL isn't a viable option, e.g., inside most corporations? WS-SecureConversation defines a standard way to do this. (For an overview of these technologies, you might take a look at http://msdn.microsoft.com/msdnmag/issues/03/04/ws-security/default.aspx#S8.)
It would be possible to define all of these things for a RESTful world, of course. But when you were done, you'd have something much like WS-Security and friends.
There are lots of situations where the relatively simple world of the Internet just doesn't apply. Because it defines things such as more capable security, WS-* will often be the right choice for cases like these.
"But REST doesn't have the consortium behind it to keep things sane that SOAP and WS-* has."
You really mean that WS-* is now sane?
You really mean that WS-* is now sane?
# posted by : July 11, 2007 5:04 PM
: July 11, 2007 5:04 PM
WS-* is absolutely sane. It's not perfect, but neither is any other technology.
Many REST fans seem to believe that since WS-* addresses problems they don't have, it must be worthless. Yet the problems of building enterprise applications inside the firewall are different from those of Internet applications. Assuming that things you don't understand are useless is not generally a good idea.
Many REST fans seem to believe that since WS-* addresses problems they don't have, it must be worthless. Yet the problems of building enterprise applications inside the firewall are different from those of Internet applications. Assuming that things you don't understand are useless is not generally a good idea.
WS-* may be sane, but it is intimidating. 37 or so specs to get your head around.
What is needed for that is a layering system that provides a simple interface for the programmer - so they never need to know anything about all those specifications, even though they get used "under the covers".
Once you think about it that way, the code can be layered either onto REST or onto WS-* through some simple configuration.
SCA anyone? :-)
What is needed for that is a layering system that provides a simple interface for the programmer - so they never need to know anything about all those specifications, even though they get used "under the covers".
Once you think about it that way, the code can be layered either onto REST or onto WS-* through some simple configuration.
SCA anyone? :-)
# posted by : July 19, 2007 9:38 AM
: July 19, 2007 9:38 AM
You're right, now everyone has the ability to choose which they're going to use. But that doesn't make this a victory, or even a truce, it's an abject surrender by the originators of SOAP, a recognition that they've been atom.xml-bombed into the ground. (Sorry, couldn't resist the pun--I don't actually use Atom for anything, I just use REST with XML or form-encoded body).
I developed one of the earliest SOAP stacks, back in 2001. The spec was changing every week, and there were constant assurances from Microsoft that it was going to spread everywhere and be interoperable with everything in a big spirit of cooperation and singing Kumbaya, and we just needed this little extra bit of complexity here, another layer of indirection there, and SOAP would be perfect.
Six years later, nobody uses SOAP. Everyone has had the ability to choose it for years, and nobody does. Everyone who used to offer a SOAP API shut it down and now just uses REST.
SOAP interop was a catastrophe if you sent more than basic data types, was hugely bloated, and offered nothing that REST didn't do better. You can claim "WS-Security will solve your security problems", but the REST world already has https, and can wrap messages in standard GPG for real message-level security if we don't trust our intermediaries.
You can test a REST endpoint with just a web browser. You can make a REST client with just a text editor to write an HTML form. You can make a REST service with just Tomcat and a Servlet, or Apache and PHP. Doing any of those with SOAP requires tools, hard work, and a good commitment of time, and gets you no additional advantage. Screw that, we're getting paid to write code, not more specifications.
I developed one of the earliest SOAP stacks, back in 2001. The spec was changing every week, and there were constant assurances from Microsoft that it was going to spread everywhere and be interoperable with everything in a big spirit of cooperation and singing Kumbaya, and we just needed this little extra bit of complexity here, another layer of indirection there, and SOAP would be perfect.
Six years later, nobody uses SOAP. Everyone has had the ability to choose it for years, and nobody does. Everyone who used to offer a SOAP API shut it down and now just uses REST.
SOAP interop was a catastrophe if you sent more than basic data types, was hugely bloated, and offered nothing that REST didn't do better. You can claim "WS-Security will solve your security problems", but the REST world already has https, and can wrap messages in standard GPG for real message-level security if we don't trust our intermediaries.
You can test a REST endpoint with just a web browser. You can make a REST client with just a text editor to write an HTML form. You can make a REST service with just Tomcat and a Servlet, or Apache and PHP. Doing any of those with SOAP requires tools, hard work, and a good commitment of time, and gets you no additional advantage. Screw that, we're getting paid to write code, not more specifications.
Yes, the war is over, and perhaps it is a truce of sorts, but it isn't quite because the zealots have realized that REST and WS* both have value. It is because:
- it's clear that REST has won the war of ideas; and
- it's also clear that REST does not (yet) have the big vendor or tooling support that WS* has.
The net result is that WS* is not going away any time soon, but REST is quietly taking over.
- it's clear that REST has won the war of ideas; and
- it's also clear that REST does not (yet) have the big vendor or tooling support that WS* has.
The net result is that WS* is not going away any time soon, but REST is quietly taking over.
# posted by : January 16, 2008 9:07 PM
: January 16, 2008 9:07 PM
If you're focused primarily on Internet services, I agree that REST will likely be dominant. If you're oriented more toward enterprise integration, however, this just isn't right. RESTful solutions aren't sufficient in some important cases here.
Much of the SOAP/REST debate is rooted in the different orientations of the warring parties. Yet whether your primary focus is Internet services or inside-the-enterprise integration, being an absolutist isn't the right approach. A pragmatic approach is always better, choosing the technology that's most appropriate for your problem.
Much of the SOAP/REST debate is rooted in the different orientations of the warring parties. Yet whether your primary focus is Internet services or inside-the-enterprise integration, being an absolutist isn't the right approach. A pragmatic approach is always better, choosing the technology that's most appropriate for your problem.
Here, it was discussed about security. i am now fine with it. How about state and transaction in REST. Say, for example, how to maintain the shopping cart for each user, and how to take care of transaction for group update.
# posted by : February 08, 2008 2:22 AM
: February 08, 2008 2:22 AM
RESTafarians differ on how best to handle state. Striving to be stateless is generally seen as a good thing, but it's not always possible, as with a shopping cart. And if you're referring to distributed transactions that require two-phase commit over Web services, this is a SOAP/WS-* scenario; REST doesn't address this problem.
For more on these issues from a RESTful perspective, take a look at the book referenced in the main post, RESTful Web Services.
For more on these issues from a RESTful perspective, take a look at the book referenced in the main post, RESTful Web Services.
Thank you so much for guiding us towards the book. I am taking a look now, hopefully I will understand this issue better.
I have been confused for a while now, specially because I am preparing my Ph.D. in SOA enhancements, I really need to take a look on every single item that exist about SOA on the Internet, tough job, don't you think so?
Post a Comment
I have been confused for a while now, specially because I am preparing my Ph.D. in SOA enhancements, I really need to take a look on every single item that exist about SOA on the Internet, tough job, don't you think so?
<< Home