Definition
When you call a function in your code, it runs right there on your computer. But what if the function you need lives on a server thousands of miles away? Remote Procedure Call (RPC) makes this possible - it lets you call functions on remote servers almost as easily as calling local ones. The network complexity disappears, and you just… call the function.
RPC represents a fundamentally different way of thinking about APIs compared to REST. While REST focuses on resources (nouns like “users,” “orders,” “products”) and standard operations on them, RPC focuses on actions (verbs like “createUser,” “processPayment,” “calculateShipping”). You are not asking “what is the state of this resource?” - you are saying “execute this specific operation and give me the result.”
This action-oriented approach often feels more natural for certain types of systems. When a banking system needs to transfer money, calling transferFunds(fromAccount, toAccount, amount) is more intuitive than constructing REST requests to multiple resources. Gaming servers, real-time communication systems, and high-performance microservices often prefer RPC because it maps directly to how developers think about the problem. Modern implementations like gRPC add performance benefits like binary protocols and streaming support that HTTP/JSON simply cannot match.
Example
Online gaming: When you move your character in an online game, your client calls something like movePlayer(playerId, newPosition) on the game server. The server validates the move, updates game state, and returns the result - all through RPC. The thousands of actions per second in multiplayer games rely on efficient RPC.
Payment processing: When you tap “Pay” on Uber, the app calls processPayment(userId, rideId, amount) on Stripe’s servers. Stripe processes the charge and returns success or failure. This is fundamentally an action being requested, not a resource being fetched.
Microservices communication: Inside Netflix, when the recommendation service needs user watch history, it might call getWatchHistory(userId) on the user service. These internal calls happen millions of times per second, and gRPC’s efficiency makes this practical.
Cloud functions: When you trigger an AWS Lambda or Google Cloud Function, you are essentially making an RPC call. You invoke a specific function with specific parameters and get a result back.
Analogy
The Phone Call to an Expert: Imagine you need legal advice. You call your lawyer and say “review this contract and tell me the risks.” You do not care where your lawyer is or what tools they use - you just want the answer. RPC works the same way: you call a remote function and get the answer without worrying about network details.
The Restaurant Kitchen Window: In a restaurant, servers do not cook food themselves. They put an order slip in the kitchen window: “make one carbonara, medium spice.” The kitchen (remote server) processes the request and returns the result (the dish). That order slip is like an RPC call - a request for a specific action.
The Remote Control: When you press “Channel 5” on your TV remote, you are sending a command that executes on the TV. You are not asking “what is the state of the TV?” - you are saying “execute this specific action.” RPC is programming’s remote control for servers.
The Vending Machine Button: You press B7 on a vending machine to get a specific snack. You do not negotiate with the machine about how to retrieve it - you just specify what you want and it executes. RPC is similarly direct: call a function, get a result.
Code Example
// JSON-RPC example
POST /api/rpc
{
"jsonrpc": "2.0",
"method": "users.create",
"params": {
"name": "Alice",
"email": "[email protected]"
},
"id": 1
}
// Response
{
"jsonrpc": "2.0",
"result": {
"id": 123,
"name": "Alice"
},
"id": 1
}
// gRPC example (Protocol Buffers)
service UserService {
rpc CreateUser(CreateUserRequest) returns (User);
rpc GetUser(GetUserRequest) returns (User);
}
Security Notes
CRITICAL: RPC APIs have different security properties than REST. Implement proper authentication and validation.
RPC vs REST:
- Action-focused: RPC specifies actions (/api/transfer_money)
- Single endpoint: Often single endpoint with different methods
- Method parameter: Method specified in request (field, URI param)
- No standard methods: Methods defined by API, not HTTP standard
- Less cacheable: Harder to cache RPC responses
Protocol Options:
- JSON-RPC: Lightweight, human-readable
- XML-RPC: Older, heavier format
- gRPC: Binary protocol, better performance
- SOAP: Enterprise standard, complex
Security Considerations:
- Whitelist methods: Only allow specific methods, deny by default
- Validate parameters: Strict validation of all parameters
- Rate limiting: Rate limit per method
- Input validation: Prevent injection attacks in parameters
- Output encoding: Encode responses to prevent XSS
Transaction Safety:
- ACID properties: Ensure atomic, consistent, isolated, durable operations
- Idempotency: Implement idempotent operations to handle retries
- Error recovery: Handle partial failures gracefully
- Timeout handling: Set appropriate timeouts for long operations
Authentication & Authorization:
- Per-method checks: Verify permissions for each method
- Client authentication: Verify client identity before processing
- HTTPS mandatory: Always use HTTPS for RPC APIs
- Token-based: Use JWT or OAuth 2.0 for authentication
Common Vulnerabilities:
- Parameter injection: Unsanitized method parameters
- Unauthorized methods: Accessible methods not intended for client
- Business logic flaws: Improper validation of business rules
- Transaction replay: Reusing transaction data across calls
- Error leakage: Revealing internal state in error messages