在REST API中哪个更好使用POST参数或JSON？

Question

In previous projects I worked on, our API would take and validate each POST argument individually by value:

$username   = isset($_POST['username']) ? $_POST["username"] : null;
$password   = isset($_POST['password']) ? $_POST["password"] : null;

Multidimensional arrays can be a bit tricky this way, though.

For a new project, I am consider a more object-oriented approach, and taking the JSON needed to construct objects instead of each individual field:

$user       = isset($_POST['user'])     ? new User($_POST['user']) : null;

Which practice is more common, and why? Are there extra security risks using one or the other?

Answer 1

There aren't any security advantages over either. If someone intercepts the request then they will be able to see the POST data whether it is in different arguments or just the body.

Make sure that you are using SSL to prevent prying eyes.

As far as JSON body vs POST arguments, it really depends on how you will be using the API. Are you going to use a front-end JS framework or jQuery? Then JSON will probably be easier for you. Does your API return JSON? Then it should probably accept JSON too.

Remember that you could always handle different content types based on the Content-Type header!