0

I am building a web app with a lot of different API calls: our own proprietary REST API, third-party library API calls, etc. All of these calls either retrieve data, update data, delete data, or create data. Virtually all of our third party dependencies provide JavaScript APIs as well as Node APIs. Initially I gravitated towards just using the JavaScript API's to make these calls from the client-side, pairing them with my components (React.js). I notice now, that as the app gets bigger and bigger, a lot of these API calls are cluttering the code. Aside from moving them to a Higher Order Component that can make all of these calls re-usable, I then feel like that I should just possibly elevate them all into Node.js so they are out of the front end code base entirely.

I am having trouble determining which direction I should go with placing these calls somewhere where they can be used effectively without cluttering the 'back-frontend' as much as possible. What are the benfits to placing all of these calls in Node as oppose to a high level client-side javascript component? Are there any design patterns / terminology that can further explain some of these designs?

Improve this question
4
  • For starters any database calls should not be done client side. Also, any passwords should not be in the client side js. Commented Dec 21, 2017 at 18:42
  • Anything you want to control execution of, put on the server-side. As a rule, you can't trust the client-side to not be tampered with. So, secrets, critical processes, sensitive data... it all goes server-side. Commented Dec 21, 2017 at 18:48
  • How does one gain this insight (besides asking a question like this on stackexchange)? Is there are a web-app design pattern that promotes what you have mentioned? Or do most developers just eventually 'realize' all of this? Commented Dec 21, 2017 at 19:00
  • Security aside, always write code where it will put you close to the problem you're trying to solve. When you're client side you're close to the user. When you're server side you're close to the system state. Some things could go either way. Code so that you're close to what you need. Commented Dec 21, 2017 at 19:38

1 Answer 1

Reset to default
1

There are two major factors at play here. Security and Cost.

  1. Cost

Every CPU cycle and MB of bandwidth on a server you own will cost you money. So there is a big drive to push as much as possible to the client.

Conversely if you are filtering data, doing this on the server before passing it to your client can, in some cases, cut down on bandwidth costs.

If you are using third party services they will often require that you pay per call to the service. In order to stop people using your account to make many calls outside of your app, You will have to keep your API key or user/password server side and make the call from there.

  1. Security

There is nothing forcing your users to use your client. If your client restricts the way in which the user uses your application; for example, Facebook doesn't let you remove adverts from your news feed. Then you must do that processing on your own server.

Otherwise someone could simply write a new facebook client which shows only your friends posts in date order and put you out of business.

Furthermore, if you want to distinguish between your users, preventing some from taking certain actions, such as having admin and normal users, those functions will have to be implemented server side and protected by some form of security.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.