[V5] Architecture question : Web + Mobile app + API server , what I should do for Auth and Data ?

[Reptiluka]

Hi ! (Sorry if some sentences aren't correct, I'm french !)

So the title is my question. I want to build a web app, a mobile app (the same project) and I want an API server to give the auth and the data from database.

If one day I have a problem with the website, and the api is hosted on this website, I don't want mobile user was unable to use the app, that why the api server is outside of that.

Following the AdonisJs doc, API Guard should be the best solution for using auth with a mobile app.

My question is, am I doing it right ? For auth my users from the website, what is the best way to store the generated token from api guard ? It is unsafe to store it in a cookie ?

Can/Should I use a mix web guard / api guard ? ex.: web guard for the website and api guard for mobile app ?

Can I simply share code between API server and my website to populate object/class from json data ?

You are all welcome to give your opinion, thank you !

[thetutlage]

Lemme attempt to answer the questions.

If one day I have a problem with the website, and the api is hosted on this website, I don't want mobile user was unable to use the app, that why the api server is outside of that.

Question is little vague. Infact, there is no direct answer to it, as an application has many layers and based a lot on which layer goes down.

• Db goes down
• Virtual Server goes down

Can/Should I use a mix web guard / api guard ? ex.: web guard for the website and api guard for mobile app ?

Yes, you can. A single app can use multiple guards. I myself will use API guard for the mobile app and web guard for web app

Can I simply share code between API server and my website to populate object/class from json data ?

With this I assume that your web app returns HTML (by rendering edge views) from the server itself. In other words, it is not a frontend SPA written in Vue or React.

Sharing code is again can be done in multiple ways. The simplest one is use content negotiation. For example:

// Fetch data as normal
// Then use the switch case to choose the response type

switch (request.accepts(['html', 'json'])) {
  case 'html':
    return view.render()
  case 'json':
    return dataAsJSON
}

Now make sure that your mobile app adds Accept: application/json in all requests and it will receive JSON

[Reptiluka]

Thanks for the reply ! 🙂

If one day I have a problem with the website, and the api is hosted on this website, I don't want mobile user was unable to use the app, that why the api server is outside of that.

It was not a question but a choice I think I will take. I think it's better (Web app [AdonisJs] / Mobile app ) connected to (Api server [AdonisJs]) instead of having the Api server inside the Web app , no ? That was the vague question haha, I made the right choice ?

In this case, if I want my backend in my API server, if I want to auth my user in my website, should I use web guard but using the API server, or instead connect directly the website app to the database without connecting to the API server ?

As I should use, I think, an API server for my mobile app, maybe it can be cool to keep all the backend in that server ?
Thats why I'm not sure about how to deal with the website, because I'm outside a normal scope of use of a all-in-one adonisjs project.

In the code you put at the end, do you mean the API server should return json code for mobile and html made by view for the web app ?
So the view should be in api server and not in the webapp ???

Thank you a lot for your time ! Even if it's a little bit related to Adonisjs and not ! 🙂

[Reptiluka]

Hi @thetutlage
(See also the reply just above)

Maybe with that schema you will see with I'm trying to explain :

In the two cases, should I create the view in the API server and send html to webapp, or create the view in web app and fill the data from api ?
Also for the auth, can I use web guard but using the API server ? Or I should connect dirrectly to the DB for the auth and get data from API ?

Thanks :)

[Reptiluka]

@thetutlage I need one last answer please 🙂