Exceptions and REST APIs

[NotionCommotion]

I asked a similar question a while back.  Should exceptions be thrown based on invalid user input?  I was told that probably not as exceptions should only be thrown on extreme edge conditions.

 

Let me ask the same question, but limit it to only a REST API using the Slim framework?

 

The framework has error handling used to catch uncaught exceptions and issue PSR7 responses.

 

Specifically for this scenario, is it wrong to throw exceptions for invalid user input?  I could use ValidationException for this purpose.  I could use built in PDOException, etc for standard exceptions.  I could use ErrorException which is thrown by exception_error_handler().

 

It seems to me that using exceptions simplifies code and better ensures a consistent interface.

[requinix]

Exceptions for invalid user input are your call. One way or another the API call will result in an error, and using exceptions to accomplish that is fine. Easy, even.

 

I wouldn't use PDOException. That's an implementation detail that doesn't matter to the API, and has a (low) chance of changing in the future while not affecting the API. I would wrap it in a more generic exception, or else let it be caught by a general catch(Exception) block at the top of the call stack and have it cause a general 500 error. (Which implies that if you don't want a 500 for a certain database error then you shouldn't leave it as a PDOException.)

[Jacques1]

Is this a one-off project which will only be maintained by you and then thrown away? In that case, you might get away with this hack. But if there's even a remote chance that somebody else may have to work with your code, I strongly recommend against it. Code which arbitrarily throws exceptions and crashes the entire application if not wrapped in plenty of try statements is a problem.

 

Exceptions are a brutal error mechanism. As you probably know, the default behavior is to immediately halt the script and emit an Internal Server Error, which makes perfekt sense if there is in fact a “hard” error. But you're dealing with “soft” errors, so you need those tricks where you throw an exception only to immediately catch it.

 

Like I said, this may be “good enough” for a quick hack. Otherwise I suggest you invest some time into a proper error handling mechanism which takes the appropriate actions and emits the right HTTP code (for automated clients, this actually matters).