title: Website based on REST in ColdFusion
body: <p>My company is about to redesign a big project from scratch. We are currently thinking about how to implement data providers. I used to integrate some webservices in the last few months and pretty much like handling data this way. So I was thinking about a RESTful design. We will be using ColdFusion 10 that comes with REST support, but I actually don't like the component structure required for it.</p>
  
  <p>The biggest advantage is probably that we'll be able to use REST to provide data for all our platforms, that is: website, mobile website and iOS/Android app. My security approach would be as follow:
  Public data can be accessed by anyone (obviously).
  Private data can be accessed with BasicAuth only.
  Using BasicAuth also allows us to have user roles with different access levels. The authorization will be implicit and based on the session/login.</p>
  
  <pre><code>&lt;!--- server-side example to request customer information (private data, BasicAuth required) ---&gt;
  &lt;cfset requestedID = 123&gt;
  &lt;cfhttp url="/customer/#requestedID#" method="get" username="#APPLICATION.REST_SYSTEMUSER#" password="#APPLICATION.REST_SYSTEMUSER_PW#"&gt;
      &lt;cfhttpparam type="url" name="includeAddresses" value="true"&gt;
  &lt;/cfhttp&gt;
  
  &lt;!--- successful response in JSON ---&gt;
  {
      "ID": 123,
      "FirstName": "John",
      "LastName": "Doe",
      "Birthday": "1970-01-01",
      "BillingAddress": {
          "Receiver": "John Doe",
          "Street": {
              "Name": "Main Street",
              "Number": "13",
              "Addition": ""
          }
          "City": {
              "ZipCode": "AB-123",
              "Name": "Sampletown",
              "District": ""
          }
      },
      "ShippingAddresses": [
      ]
  }
  
  &lt;!--- deserialize JSON and build an object to use server-side (the constructor wraps the data and adds functions to it) ---&gt;
  &lt;cfset customerJSON = deserializeJSON(CFHTTP.FileContent)&gt;
  &lt;cfset customer = createObject("component", "Customer").init(customerJSON)&gt;
  </code></pre>
  
  <p>Here are the <strong>questions</strong> that came to my mind:</p>
  
  <ol>
  <li>Is it smart to use this general REST approach for everything on
  every single page? (Is it smart to use REST on websites to begin
  with?)</li>
  <li>Do local HTTP requests impact performance and slow down page
  loading?</li>
  <li>Is BasicAuth sufficient to protect the data? (I would just add minor
  security features such as request-spam-protection to it)</li>
  <li>Is it best to avoid having dependencies within the webservice like
  <code>/customer/</code> accessing <code>/address/</code> to receive its data?</li>
  </ol>
  
  <p>On some of the other (older) website we have file based data providers (includes and components that take care of database access etc.), but we experienced several issues with the more complex pages (such as a checkout process) like name conflicts through includes, intransparent and heavy components, mixing up model/view/controller elements etc.</p>