AJAX, REST APIs, and Securing Endpoints

Harry · 13 Sep 2026 · 2 views

Part 1 - AJAX and Dynamic UIs

AJAX keeps pages responsive by updating parts of the UI without a full reload. Grails handles JSON responses and partial rendering natively.

def search() {
    render User.findAllByUsernameLike("%${params.q}%") as JSON
}

fetch('/user/search?q=adm')
  .then(res => res.json())
  .then(data => console.log(data))

For partial updates, render a template instead of a whole page:

render template: "userList", model: [users: User.list()]

Always return proper HTTP statuses on errors and keep CSRF protection enabled.

Part 2 - RESTful Web Services

REST is the standard for SPAs, mobile apps, and third-party integrations. Grails gives first-class support via RestfulController:

import grails.rest.RestfulController

class UserController extends RestfulController<User> {
    static responseFormats = ['json', 'xml']
}

This one class provides index, show, save, update, and delete. Content negotiation picks JSON or XML from the Accept header or URL extension.

Design resources with nouns, not verbs:

GET    /users
POST   /users
GET    /users/1
PUT    /users/1
DELETE /users/1

HTTP Status Codes

respond user, status: CREATED
respond user.errors, status: BAD_REQUEST

API Versioning

Version early so breaking changes never hurt clients:

URL-based - /api/v1/users, /api/v2/users.
Namespace controllers - package v1, package v2.
Header-based - Accept: application/vnd.app.v1+json.

Deprecate gradually and never remove fields abruptly.

Securing REST APIs

APIs expose data, so treat them as a separate attack surface. Use token-based auth (JWT is the most common), keep APIs stateless, and disable sessions.

@Secured('ROLE_USER')
class UserApiController extends RestfulController<User> {
    static responseFormats = ['json']
}

The JWT flow: the client logs in, the server issues a signed token, the client sends it with every request, and the server validates it statelessly.

API Security Checklist

Always use HTTPS in production.
Validate tokens on every request.
Limit what each payload exposes.
Apply rate limiting to abusive clients.
Document with OpenAPI/Swagger or Springdoc.