HTTP Requests Explained: GET, POST, PUT, DELETE

Postman is a Chrome-based application for testing APIs with a user-friendly interface. It allows setting headers, parameters, and request bodies. To test the Robot Wars API, you can send GET requests to /robot-models to list all robots, or filter by name using query parameters (?name=robot1). Postman can import requests from documentation and supports testing different endpoints. It also generates cURL commands for command-line testing. Postman is particularly useful for manual API testing and understanding API capabilities.

To test APIs in Postman, select the appropriate HTTP method, enter the API URL, and configure the request body. For JSON-formatted requests, select 'raw' and choose 'JSON' as the format, then paste the JSON data. Testers should verify responses by checking status codes (200 indicates success) and examining the response body. After creating a user, testers can verify the resource exists by checking the system or attempting to access it. Testers can also test with query parameters through the 'Params' tab.

Postman is a popular tool for testing HTTP APIs outside of a browser. It allows you to send HTTP requests (GET, POST, PUT, DELETE) to your server endpoints and view the responses. This is invaluable for testing API routes before building frontend interfaces. You can set request methods, headers, and body content directly in Postman, making it much easier than writing test code or using curl commands.

Postman is a platform for building and using APIs that helps organize requests, create collections, and automate testing. Key concepts include making HTTP requests (GET, POST, PUT, DELETE), using variables for reusable values, setting up authentication with tokens, writing JavaScript tests to validate responses, and running collections through the Collection Runner for batch testing. The platform also offers monitors for scheduled API testing and email notifications.

Postman is an API testing tool for sending requests, viewing responses, and testing APIs. Key features: collections for organizing requests, environment variables for dynamic data, test scripts for validation, and Swagger integration for API documentation. Postman enables testing backend APIs directly without frontend.

Express provides methods to define routes that handle incoming HTTP requests. The 'app.get(path, handler)' method creates routes for GET requests. Route handlers receive 'request' (containing query parameters, headers, and body) and 'response' (used to send data back). Query parameters are accessed through 'request.query' and are appended to URLs after the question mark. Express does not automatically parse JSON bodies, requiring 'app.use(express.json())' middleware. Nodemon automatically restarts the server when code changes, improving development workflow.

This section provides comprehensive coverage of Express.js routing and response handling. It explains how to define routes using app.get(), app.post(), app.put(), and app.delete() methods with path and callback parameters. The tutorial covers returning JSON responses using res.json() which automatically sets Content-Type headers. It explains the importance of the callback function in app.listen() to ensure code runs after the server starts. The section introduces RESTful API architecture, explaining how REST uses standard HTTP methods (GET, POST, PUT, DELETE) to perform CRUD operations on resources with unique URL endpoints. Dynamic routes using colons (/:id) are introduced for capturing URL parameters.

Express.js routing defines endpoints and their handlers. Best practices include creating separate route files for different resources, using a main router to combine routes, and implementing the controller pattern where business logic is separated from route definitions. Controllers contain functions that handle requests and return responses. Error handling uses custom error classes extending Node.js Error with status codes and messages. Error middleware catches errors and returns appropriate responses, registered as the final middleware.

This comprehensive lesson covers dynamic routing in Express.js using URL parameters. Parameters are created by adding colons (e.g., '/ola/:nome') to make routes flexible. The req.params object retrieves these values, enabling personalized responses like 'Olá Victor'. Key best practices include: calling res.send() only once per request to avoid header errors, combining multiple response elements into single strings, and using nodemon for automatic server restarts during development. The instructor emphasizes practical learning over theory, demonstrating concepts through hands-on coding examples including HTML embedding and error troubleshooting.

Express.js is a minimal and flexible Node.js web application framework. Key concepts include: (1) Express app() - creates an Express application instance, (2) app.use() - adds middleware to the application, (3) app.get() - defines GET route handlers, (4) app.post() - defines POST route handlers, (5) app.listen() - starts the server on a specified port, (6) Middleware functions - can access request and response objects.

This section covers HTTP security configuration and CORS setup for cross-origin requests. The HTTP security configuration includes: CSRF disable for stateless JWT authentication, authorizeHttpRequests() with permitAll() for public endpoints and authenticated() for protected routes, sessionManagement().stateless() for JWT statelessness, and addFilterBefore() to add custom filters before default filters. The CorsConfigurationSource bean configures allowed origins (backend.com, localhost:8080), allowed methods (GET, POST, PUT, DELETE), and allowed headers (Authorization, Content-Type). This enables the frontend application to communicate with the backend API across different origins while maintaining security.

This comprehensive section covers two critical web security mechanisms. CORS (Cross-Origin Resource Sharing) controls how browsers handle requests from different origins, preventing unauthorized websites from accessing your server's resources. Configuration uses anyOrigin and allowedOrigins flags to specify permitted origins. When browsers make cross-origin requests with unknown origins, the server responds normally but the browser blocks execution. CSRF (Cross-Site Request Forgery) exploits authenticated user sessions by triggering hidden form submissions. Protection uses the double submit cookie pattern, requiring matching cookie and token values. In ZIO HTTP, this is implemented through csrfGenerate (creates token and sets cookie) and csrfValidate (verifies token matches cookie) middlewares. Both mechanisms are essential for protecting data-intensive web applications.

Cross-Origin Resource Sharing (CORS) controls how resources from one origin can be accessed from another. When a web application on one domain makes requests to a backend on another domain, the browser sends a preflight OPTIONS request first. The server responds with CORS headers specifying allowed origins, headers, and methods. Without proper CORS configuration, browsers will block cross-origin requests, preventing the application from functioning correctly.

This extensive section traces the evolution from simple HTTP Basic Authentication to OAuth2 for securing modern distributed systems. HTTP Basic Authentication, while easy to implement, suffers from severe limitations: secret management becomes unmanageable as systems scale (N-squared growth), it only supports simple username/password authentication without multi-factor capabilities, and it lacks fine-grained permission information requiring additional database lookups. OAuth2 addresses these limitations by providing a standardized, HTTP-based protocol that carries more information than basic auth, supports multi-factor authentication, and enables interoperability across different platforms and programming languages. The decision to adopt OAuth2 is driven by the need for centralized identity management, fine-grained authorization, and compliance requirements from auditors and managers. The core Authorization Code Grant flow enables secure delegated access: users are redirected to the authorization server for authentication, receive an authorization code, exchange it for an access token, and then use that bearer token to access protected resources. Bearer tokens allow any party possessing the token to claim authorization, introducing security considerations around token theft. JSON Web Tokens (JWT) provide a compact, URL-safe means of representing claims, consisting of signed header, payload, and signature components that enable offline validation while supporting asymmetric cryptography for secure verification.

API authentication methods include Basic Auth (simple username/password with Base64 encoding, suitable for internal tools but insecure over plain HTTP), Bearer Tokens (opaque tokens stored in databases requiring server-side validation on each request, offering revocation capability but database lookup overhead), and JWTs (self-contained tokens with header, payload, and signature that enable stateless verification without database queries, faster but harder to revoke). Choose Basic Auth for internal tools, JWTs for scalable public APIs, and Bearer tokens for standard web apps, always using HTTPS and short-lived tokens with refresh tokens for security.

Application layer protocols sit atop TCP/UDP, defining message formats and request-response patterns. HTTP/HTTPS (foundation of web APIs) uses request-response cycles with methods (GET, POST, PUT, PATCH, DELETE), status codes (200 success, 400 client error, 500 server error), and headers for caching/authorization. HTTPS adds TLS/SSL encryption for security. WebSockets solve HTTP's real-time limitations by establishing persistent connections for bidirectional communication without repeated requests. AMQP enables asynchronous communication through message brokers with queues. gRPC uses Protocol Buffers for efficient binary serialization and HTTP/2 for transport, ideal for microservices.

WebTransport is a new web protocol that provides developers with low-level control over network streams, enabling bidirectional communication, unidirectional streams, and unreliable datagram delivery (similar to UDP) over HTTP/2 and HTTP/3, addressing limitations of existing protocols like WebSockets and gRPC which lack direct browser support or sufficient flexibility for real-time applications.

Distributed computing involves multiple servers working together to handle complex applications. Traditional web applications follow the client-server model where clients send HTTP requests and receive responses, but this model has limitations for realtime applications. HTTP is a request-response protocol where servers can never push events directly to clients. Long polling and Server-Side Events are alternatives but have drawbacks like unnecessary server load and delays. WebSockets solve these problems by establishing persistent connections that remain open until explicitly closed, enabling both clients and servers to send data at any time. Realtime systems like chat applications and multiplayer games require this persistent connection for immediate updates. WebSockets use TCP for reliable delivery, making them suitable for chat where missing messages is unacceptable, while WebRTC uses UDP for faster communication but may miss packets. Scaling realtime systems requires multiple servers communicating through technologies like Redis. Creating a WebSocket server in Node.js requires using a library like ws with a native HTTP server object. Testing can be done using tools like Postman's WebSocket section or by writing simple client scripts.

Application layer protocols sit at the top of the network stack, defining message formats, request-response patterns, and connection management. HTTP consists of requests (method, URL, headers) and responses (status code, headers, body). Common methods include GET, POST, PUT, PATCH, DELETE. Status codes indicate success (200), client errors (400), or server errors (500). HTTPS adds TLS/SSL encryption for data protection. WebSockets enable full-duplex communication over a single TCP connection, allowing servers to push data without waiting for requests (ideal for real-time applications). AMQP handles asynchronous message queuing. gRPC uses HTTP/2 and Protocol Buffers for high-performance RPC with built-in streaming. Protocol selection depends on interaction patterns, performance requirements, client compatibility, and security needs.

gRPC uses .proto files with Interface Description Language (IDL) to define message structures and services. The compiler generates code for creating messages, encoding, and decoding across multiple programming languages. Services are defined with method names, input/output message types, and the framework generates server implementations that listen on network ports and client stubs that send requests. gRPC leverages HTTP/2 protocol providing binary format, message compression, multiplexing (multiple requests over single connection), and header optimization. HTTP/2 enables full-duplex streaming: server-side streaming (server sends messages in response), client-side streaming (client sends messages), and bidirectional streaming (both sides send independently). gRPC guarantees message ordering within streams and supports cancellation.