Questions about REST API?

Question

PHP

Hello, my question is probably stupid and I didn’t look for answers well, but tell me:
1. to pass json to api, be sure to use a link to a page with json, or somehow you can pass json directly to html. For example:
not so
api - json
test - html page,

but what would be like this
test - json and html page

2. For example, the admin role has a button that should be displayed, but a simple user should not be displayed as for REST this should be implemented ? That is, the client makes a request for a role to the backend and then, depending on the response, show or hide the button through display: block / none.

3. How should user authorization be checked correctly? I heard that a field should be created in the database where the authorization token is stored and will be deleted if there has not been a request for a token for a long time. But what if we use sessions? Will this break REST a lot?

4. How to make csrf protection in api?

Sorry to take up your time with such stupid questions, but I can not find detailed and understandable information on this topic.

Answer 1

First, REST is not a standard, not strict rules, it's a recommendation.
The whole essence of these recommendations boils down to two things:
- Each resource (document, entity data) has its own URI
- For each action with a resource, its own HTTP request method is proposed
. Now for the questions:
1. If json and html data is simple different representations of the same resource, they may well live on the same URI. For example, a different representation is given depending on the HTTP header Accept.
2. REST does not regulate in any way how you build an application. It can be a separate request to the "role" entity or be part of the "user" entity, it's up to you.
3. Again, REST has nothing to do with it at all. In REST, there are no databases, sessions, or anything else that you use under the hood encapsulated from the client.
4. CSRF is done as in any other case. Here is the article: https://habr.com/en/post/318748/