REST API设计-获取所有用户，如何处理私人信息？

Question

I'm working on a REST API and getting a little lost in my head. I have a Model for Users, and I'm storing the (salted) passwords in a database.

Consider a consumer of the API: I would want them to be able to get all other users public info (GET /users, /users/:id) but I would want the passwords to be left out.

However if for example I wanted to update info of the logged in user in a regular PUT request, then I wouldn't have the user's existing password to send in the PUT request - so a PUT request would only do a partial update of the user on all it's other fields. This doesn't seem very RESTful. (Maybe I should use PATCH? It seems patch isn't widely used. Is there a reason for this?)

Right now I'm thinking of having a POST at /users/:id/updatePassword to update passwords and then a PUT at /users/:id to update everything else about the user EXCEPT the password, and no way to retrieve a users password from the API.

However to me this feels .... strange. Maybe it's not, but just wondering if anyone has any better ideas how to design this?

Thanks

Answer 1

First of all, you should not stored your users password encrypted. You should salt and hash them and store the hash of the salted password.

The database model of your user does not have to match the resource you expose in your REST API to the user. When you use PUT to update the user, you should expect all fields in the resource as PUT is idempotent.

The way you propose to update the password (using POST /users/:id/updatePassword is perfectly fine and RESTful. In your database model, you can combine the password hash with the other fields of the user, but in your resource, you keep them separate.