Meme transcription: Panel 1. Two images of JSON, one is the empty object, one is an object in which the key name maps to the value null. Caption: “Corporate needs you to find the difference between this picture and this picture”
Panel 2. The Java backend dev answers, “They’re the same picture.”
If you’re branching logic due to the existence or non-existence of a field rather than the value of a field (or treating undefined different from null), I’m going to say you’re the one doing something wrong, not the Java dev.
These two things SHOULD be treated the same by anybody in most cases, with the possible exception of rejecting the later due to schema mismatch (i.e. when a “name” field should never be defined, regardless of the value).
They're semantically different for PATCH requests. The first does nothing, the second should unset the
namefield.Only if using JSON merge patch, and that's the only time it's acceptable. But JSON patch should be preferred over JSON merge patch anyway.
Servers should accept both null and undefined for normal request bodies, and clients should treat both as the same in responses. API designers should not give each bespoke semantics.
JSON patch is a dangerous thing to use over a network. It will allow you to change things inside array indices without knowing whether the same thing is still at that index by the time the server processes your request. That’s a recipe for race conditions.
That's what the If-Match header is for. It prevents this problem.
That being said, I generally think
PUTs are preferable toPATCHes for simplicity.Why?
Because Java struggles with basic things?
It's absurd to send that much data on every patch request, to express no more information, but just to appease the shittiness of Java.
Why are you so ignorant?
Why not explaining instead of looking down on people? Now they know they're wrong bit don't know why. Nice.
You've replied to the wrong person.
Ya, having null semantics is one thing, but having different null and absent/undefined semantics just seems like a bad idea.
Not really, if absent means "no change", present means "update" and null means "delete" the three values are perfectly well defined.
For what it's worth, Amazon and Microsoft do it like this in their IoT offerings.
Zalando explicitly forbids it in their RESTful API Guidelines, and I would say their argument is a very good one.
Basically, if you want to provide more fine-grained semantics, use dedicated types for that purpose, rather than hoping every API consumer is going to faithfully adhere to the subtle distinctions you've created.
They're not subtle distinctions.
There's a huge difference between checking whether a field is present and checking whether it's value is null.
If you use lazy loading, doing the wrong thing can trigger a whole network request and ruin performance.
Similarly when making a partial change to an object it is often flat out infeasible to return the whole object if you were never provided it in the first place, which will generally happen if you have a performance focused API since you don't want to be wasting huge amounts of bandwidth on unneeded data.
The semantics of the API contract is distinct from its implementation details (lazy loading).
Treating null and undefined as distinct is never a requirement for general-purpose API design. That is, there is always an alternative design that doesn't rely on that misfeature.
As for patches, while it might be true that JSON Merge Patch assigns different semantics to null and undefined values, JSON Merge Patch is a worse version of JSON Patch, which doesn't have that problem, because like I originally described, the semantics are explicit in the data structure itself. This is a transformation that you can always apply.
No there isn't.
Tell me how you partially change an object.
Object User :
{ Name: whatever, age: 0}
Tell me how you change the name without knowing the age. You fundamentally cannot, meaning that you either have to shuttle useless information back and forth constantly so that you can always patch the whole object, or you have to create a useless and unscalable number of endpoints, one for every possible field change.
As others have roundly pointed out, it is asinine to generally assume that undefined and null are the same thing, and no, it flat out it is not possible to design around that, because at a fundamental level those are different statements.
As I already said, it's very simple with JSON Patch:
Good practice in API design is to permissively accept either undefined or null to represent optionality with same semantics (except when using JSON Merge Patch, but JSON Patch linked above should be preferred anyway).
I.e. waste a ton of bandwidth sending a ridiculous amount of useless data in every request, all because your backend engineers don't know how to program for shit.
Gotcha.
It's about making APIs more flexible, permissive, and harder to misuse by clients. It's a user-centric approach to API design. It's not done to make it easier on backend. If anything, it can take extra effort by backend developers.
But you'd clearly prefer vitriol to civil discourse and have no interest in actually learning anything, so I think my time would be better spent elsewhere.
This is also how it is defined in the JSON Merge Patch RFC.
it does feel ambiguous though as even what you outlined misses a 4th case. if null means delete, how do I update it to set the field to null?
It gets more fun if we're talking SQL data via C API: is that 0 a field with 0 value or an actual NULL? Oracle's Pro*C actually has an entirely different structure or indicator variables just to flag actual NULLs.
Except, if you use any library for deserialization of JSONs there is a chance that it will not distinguish between null and absent, and that will be absolutely standard compliant. This is also an issue with protobuf that inserts default values for plain types and enums. Those standards are just not fit too well for patching
I've never once seen a JSON serializer misjudge null and absent fields, I've just seen developers do that.
Well, Jackson before 2.9 did not differentiate, and although this was more than five years ago now, this is somewhat of a counter example
Also, you sound like serializers are not made by developers
Bruh, there's a difference between the one or two serializing packages used in each language, and the thousands and thousands and thousands of developers who miscode contracts after that point.