HTTP overhead in API-centric PHP application

Question

I am reorganizing an existing PHP application to separate data access (private API calls) from the application itself.

The purpose of doing this is to allow for another application on the intranet to access the same data without duplicating the code to run the queries and such. I am also planning to make it easier for developers to write code for the current web application, while only a few team members would be adding features to the API.

Currently the application has a structure like this (this is only one of many pages):

• GET /notes.php - gets the page for the user to view notes (main UI page)
• GET /notes.php?page=view&id=6 - get the contents of note 6
• POST /notes.php?page=create - create a note
• POST /notes.php?page=delete - delete a note
• POST /notes.php?page=append - append to a note

The reorganized application will have a structure like this:

• GET /notes.php
• Internal GET /api/notes/6
• Internal POST /api/notes
• Internal DELETE /api/notes/6
• Internal PUT /api/notes (or perhaps PATCH, depending on whether a full representation will be sent)

In the web application I was thinking of doing HTTP requests to URLs on https://localhost/api/ but that seems really expensive. Here is some code to elaborate on what I mean:

// GET notes.php

switch ($_GET['page']) {
    case 'view':
        $data = \Requests::get(
            "https://localhost/api/notes/{$_GET['id']}",
            array(),
            array('auth' => ... )
        );
        // do things with $data if necessary and send back to browser
        break;
    case 'create':
        $response = \Requests::post( ... );
        if ($response->status_code === 201) {
            // things
        }
        break;
    // etc...
}

I read this discussion and one of the members posted:

Too much overhead, do not use the network for internal communications. Instead use much more readily available means of communications between different process or what have you. This depends on the system its running on of course...Now you can mimic REST if you like but do not use HTTP or the network for internal stuff. Thats like throwing a whale into a mini toilet.

Can someone explain how I can achieve this? Both the web application and API are on the same server (at least for now).

Or is the HTTP overhead aspect just something of negligible concern?

Making HTTP requests directly from the JavaScript/browser to the API is not an option at the moment due to security restrictions.

I've also looked at the two answers in this question but it would be nice for someone to elaborate on that.

Answer 1

The HTTP overhead will be significant, as you have to go through the full page rendering cycle. This will include HTTP server overhead, separate process PHP execution, OS networking layer, etc. Whether it is negligible or not really depends on the type of your application, traffic, infrastructure, response time requirements, etc.

In order to provide you with better solution, you need to present your reasoning for considering this approach in the first place. Factors to consider also include current application architecture, requirements, frameworks used, etc.

If security is your primary concern, this is not necessarily a good way to go in the first place, as you will need to now store some session related data in yet another layer.

Also, despite the additional overhead, final application could potentially perform faster given the right caching mechanisms. It really depends on your final solution.

Answer 2

I am doing the same application framework. Had the same problem. So I decided to do following design:

1. For processes that are located remotely (on a different machine) then I user crul or other calls to a remote resource. If I store user on a different server to get user status I do this API->Execute(https://remote.com/user/currentStatus/getid/6) it will return status.
2. For local calls, say Events will require Alerts (these are 2 separate package with their own data model but on the same machine) - I make a local API like call. something like this: API->Execute(array('Alerts', Param1, Param2).

API->Execute then knows that's a local object. Will get the object local physical path. Initialize it, pass the data and return the results into context. No remote execution with protocols overhead.

For example if you want to keep an encryption service with keys and what not away from the rest of the applications - you can send data securely and get back the encrypted value; then that service is always called over a remote api (https://encryptionservice.com/encrypt/this/value)