Middleware and Other Useful Looking Things #46
Description
Related documentation: http://edgeguides.rubyonrails.org/api_app.html#choosing-middleware
I'm transcribing some notes I made when first creating the API:
- caching (should this be automatic or should it be triggered by ES content update?)
- AR serializers - probably not very useful?
- v1 in url - probably do with apache? or should we namespace controllers, etc?
- cors - probably only allow GET requests
- Rack::Attack middleware - should we throttle after certain num reqs / sec? Or whitelist only api keys? Both?
- Auth - leave AR in case we track this
- ES + Rails gem? - opting not to use this in favor of creating our own queries, though possibly it would help with error handling?