Error Feedback for Web Services
Monday, May 18. 2009
Since we already loop through the $_POST variable we could further extend that to add a bit of security by validating the values, the length, the characters, the expected values and so on.
Bu than again, that would be on a different chapter. Congrats for yet another great reading.
Thanks for this good article.
You may also need to consider what language the end user needs the message in. I have seen too many systems that just pass an English error message from a web service on to a user who does not speak English.
If the web service sends the error message back in the end users language, you should have a short error code before the message text. For example ‘E001 username is missing’.
Without a standard code for each error, looking through log files with messages in lots of languages for a problem is horrible, but that is easy compared with trying to program around a response that could be in one of six languages that you do not speak.
Instead of using this approach, why not use the Specification pattern to validate your data… Doesn’t have to be from a POST, data could be from another source – anything in fact where rules apply.
It frightens me that in this day and age that this pattern is often not implemented by many developers, yet I’ve been using it for the past 3 odd years now.
Lack of education I feel but I don’t want to go off topic as it’s not my blog; the point mentioned by Lorna to me is obvious but again often forgotten :(
Lack of logic I feel (there I go again, having another moan…).
Happy trails.
Stelian, Nick and Les: You all make really excellent points on how this example could be extended to take into account some of the other issues which will be needed to turn this into a working system. Proper data validation is essential but outside the scope of this tutorial. And the point about the English error messages is great – usually I use some config vars to hold the actual messages so I can point to which language I need. Again though, it would have made this example more complicated than I needed to illustrate my point.
Thanks so much for your input :)
I do something similar Lorna, except my $messages is an array of arrays, keyed by the field in question. You can also get rid of the $can_proceed by testing if the messages array is empty.
$errMessages = array();
$name = isset($_POST[‘name’]) ? $_POST[‘name’] : null;
if(!$name){
$errMessages[‘name’][] = ‘Required field’;
}
if($name != ‘Richard’){
$errMessages[‘name’][] = ‘Your name is not Richard’;
}
if($errMesssages){
// handle errors
}else{
// continue
}
It’s useful to retain the field=>error information so that you can display the error message next to the input field in the UI, or provide more context for the consumer of a web-service.
(I will normally json_encode that array and inject the json into my html page in the view, and then use Javascript to enhance the html input fields based on that data.)
Rich: Oh hello :) Your example makes a lot of sense for working with web forms – my example works with a service so its simply a request/response format but I do like the way the example is extended. And you managed to get geshi working in my comments form, amazing!



This is a mini series on points to consider when designing and building web services. So far there have been posts on error feedback for web services, auth mechanisms for web servicesand
Tracked: Jun 30, 21:30
This the last entry in a mini series on points to consider when designing and building web services. So far there have been posts on error feedback for web services, auth mechanisms for web services, saving state in web services and using version paramet
Tracked: Jul 02, 15:48
Over the summer months I wrote a series of posts about designing APIs in general, and web services in particular. This included posts on status codes for web services, error feedback for web services, auth mechanisms for web services, saving state in web
Tracked: Oct 28, 08:51