0

My current project involves building an online store on top of Magento CE 1.9, and native mobile apps that can do pretty much everything the website can minus the HTML and minus the need to pay for an extension or library. I've been scouring the web for any way to do this in Magento, and I have come up with the following insights (please do correct me if I'm wrong):

  1. REST is extremely painful to implement for mobile. Callback URLs almost never work, and the one way I got it to work requires the user to manually login to the website, approve the issuing of a token from inside the browser, and is left to handle the oauth token and secret himself. I am of the thought that the only thing a user needs to do from the app is login, and the server responds with the token the app can use to access data. If someone can show me how this can be done, please let me know.

  2. SOAP is both too slow and too powerful. Too slow since it takes several seconds just to query basic information, and too powerful since it can query almost anything, even information that shouldn't be exposed to a customer. I am also not sure where SOAP related code should be placed. Should the whole API be exposed to the app, or should such code only be handled server-side and passed back to the client?

  3. Custom PHP file calling Mage seems to be the simplest way to do things. Right now my app talks to a custom PHP file residing in a user-made directory that uses Mage.php to do the things it needs. Through this PHP script I can authenticate the user, have fine control over the data being queried, and easily handle requests and responses using simple HTTP POST or GET. My concern though is that this isn't an API per say, and I am not experienced enough in web development to know if this method has bad security implications. Is it bad that no tokens are involved? Is the fact that the URL is static a problem? #3 is my preferred method of doing things, but if it's really insecure, please let me know.

Again, these are the things I have noticed from experience and research. If anyone has found a simple, secure way, please let me know about it, and please provide as much guidance and sample code as you can since Magento itself doesn't provide nearly enough. Thanks again!

Improve this question

1 Answer 1

Reset to default
2

You are forgetting:

  1. And what has been made for this: the XMLConnect API.

It's issue has always been documentation and promotion. But not anymore:

Magecast Episode on API's by Fabricio Branca

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.