REST and SOAP

Don Box on REST vs. SOAP...

In hopes I never have to address this debate again...

The debate seems just to be getting started and has a long way to go. I hope Microsoft has not made up their minds yet.

The following design decisions are orthogonal, even though people often conflate two or more of them...

1. Whether one uses SOAP or POX (plain-old-XML).
2. Whether or not one publishes an XML schema for their formats.
3. Whether or not one generates static language bindings from an XML schema.
4. The degree to which one relies on HTTP-specific features. That stated, screw with GET at your peril.
5. Whether one adopts a message-centric design approach or a resource-centric design approach.

Some of the decisions (specifically 5) are architectural and sometimes philosophical.

What does "philisophical" mean? Does "philisophical" mean "does not count"?

Some of the decisions (specifically 1-2) are simple business decisions that are determined by who your target audience is.

What does "simple business decision" mean? (Let's ignore the "simple" part and just consider "business".) I can understand the decisions could have a value and a cost associated with them. But which ones would not?

1. If you want a great experience for .NET/Java devs, you’ll typically publish schemas (through wsdl) and support SOAP.
2. If you want a great experience for LAMP folks, you’ll support POX messages and will provide a non-XSD description of your formats.
3. If you want to reach both audiences, you’ll do both #1 and #2.
4. If you want to reach both audiences before your competition does, you'll avoid indulging in religious debates and ship something.

Starting with (1), what does "great experience" mean? Great *initial* experience? And does that slash mean dotnet *or* java? Or does it mean dotnet *and* java together?

My recent experience (in which I was shocked how little interoperability, not to mention functionality, has been accomplished in the WSDL and SOAP world over the last several years) tells me that if the target is either dotnet *or* java then your chances are significantly better than targetting both. (But then if separate, the questions becomes again *why* WSDL and SOAP when a proprietary solution could do better still.

Doing (3) seems like a lot of work when perhaps (2) would work well for all. Again my recent experience supports that. I think (1) works for vendors whose tools have been aimed at (1) but only *initially*. What little experience I have in this area has even so raised huge warning flags that the initial joy of a dotnet or java SOAP and WSDL toolkit very soon runs out of gas (i.e. I have not seen quantifiable benefits for choosing WSDL and SOAP over real HTTP), yet introduces problems of its own (complexity, lack of interop, little support for versioning, magic instead of repeatability, little in the way of testability).

That last one about shipping something is interesting. In a recent experiment a small group and I found ourselves wrestling a lot with WSDL and SOAP (this was a dotnet *and* java experiment rather than a dotnet *or* java experiment). Wanting to quickly put that behind us, we decided to run a different experiment... address the same business problem but with just HTTP. Very soon we were spending all our time talking about business functionality and messages rather than infrastructure headaches.

And yes, we could have at that time very easily thrown in LAMP, Lisp, Smalltalk, Erlang, etc. Anything that can do simple HTTP could be a full participant. The interfaces were narrowed and became a non-issue. The messages and the funcationality became the concern -- what is the business functionality? what is the message description? (We used xsd's and so I can attest to the above statement about schemas being independent of SOAP, WSDL, etc.)

Mark Baker has additional useful comments and pointers to other recent items (here and here for example) about this debate. To repeat myself, this seems far from over, and neither should it be. There is a lot more to discuss. The lists above from Don seem oversimplified. From his accompanying text, he seems too eager to conclude with this list and live by it. I don't see how that would help anyone.

Update: Mike Champion makes an analogy between messaging technologies (SOAP/WSDL and HTTP) and road vehicle types (trucks and cars). Unfortunately this is an arbitrary analogy. That is, saying that SOAP/WSDL is best "to haul a lot of heavy stuff securely and reliably, use a truck" does not make it so. The question is how to make an objective determination.

Update Day 3: As Chris Ferris says, the saga continues. Chris plays the "if only you knew what I know" card. That could be a good card to play, as I am only reporting what little I know. That is not much, but at least it is based on hands-on experiments.

But Chris appears to advocate SOAP/WSDL over HTTP on the basis of reliable messaging. Here's my (limited) experience... several popular SOAP/WSDL toolkits fail to easily interop over HTTP using unreliable messaging. Should I come back in a few years to see where they stand on reliable messaging? Chris admits...

I will concede that it is taking longer than I might like to drive the WS-* specifications through the standards process.

Yet the standards that are in place already seem open to arbitrarily incompatible interpretations. And the toolkits I have seen appear to do the darnedest things to generate complicated code and require programmers to jump through obscure hoops without a net.

Chris -- promises of paradise sometime in the future may come true, but I don't see that as a reason to invest in the mess we're forced to deal with today.

Stefan Tilkov writes...

If you’re talking about SOA at an enterprise level... whether you end up doing POX over HTTP in a RESTful or unRESTful way, or use WSDL and SOAP with a code-first or contract-first approach, is not the sort of thing that matters...

But he seems to agree there is a significant technical debate. I'm not sure I agree the technical debate does not matter at the enterprise level. The most significant enterprise IT issue I am aware of is the inability to get out from under undesirable technical legacies. My fear is the current SOAP/WSDL, etc. conglomeration is not a wedge for loosening older legacies, but could turn out to be its own significant layer of cruft that drains more resources from focusing on pure business value.

On reliability, security, etc. within the enterprise, Mike Champion in a comment on his blog writes...

Typical enterprise IT shops tend see the Web as a necessary evil to communicate with customers, and must invest heavily in tools and expertise to get acceptable security / reliability; they generally use databases or enterprise message oriented middleware (e.g. MQ) to handle internal communications securely and reliably.

And I agree with this observation. I can see a place within the enterprise for HTTP as well as for some other API or protocol-based database and messaging systems. I don't see HTTP as being the only protocol, especially within an enterprise. However I don't see SOAP/WSDL at *this* point adding value to any of these. Experience shows they are complicated, vague, and underdeveloped (relative to what the adopted and in-progress specifications might lead you to believe.)

Each has their place... but where? Kurt Cagle adds to the discussion. He makes a statement I have heard before, "both have their place". I don't recall seeing useful information about where these appropriate places are for SOAP/WSDL. Some people think they belong between enterprises. Others believe they belong within an enterprise. Kurt appears to uphold the latter at least in part, but I am not sure.

My sense from limited hands-on experience is that the more one's interfaces depend on SOAP and WSDL the more difficult they will be to change. I would be interested in contrary experiences. The last thing an IT shop needs is more cruft that is difficult to change.

Update Day 4: Dare Obasanjo makes constructive observations until he falls back to the apparently default advice...

If you know the target platform of the consumers of your service is going to be .NET or some other platform with rich WS-* support then you should use SOAP/WSDL/WS-*. On the other hand, if you can't guarantee the target platform of your customers then you should build a Plain Old XML over HTTP (POX/HTTP) or REST web service.

Again the "rich" support appears to hold if one does not care about interop. But then the question is, why use SOAP/WSDL for a non-interop scenario? Certainly there are better solutions when confined to just C# or java.