October 2011 - web-devel

"Wiki" section of the Yesod doc site
by Michael Snoyman 13 May '12

13 May '12

Hi everyone, I've added a new section to the Yesod doc site: the wiki[1]. This section is intended to be user-writable, so if you have any content you'd like to submit, please go ahead. In particular, this section contains the "Powered by Yesod" page: please add your sites. Unfortunately, the list from the old wiki was lost when my previous VPS died. (All my databases were backed up, I just forgot to backup the Wiki content as well...) Michael [1] http://www.yesodweb.com/page/wiki

5 7

[Yesod] where Yesod.Helpers.Crud is?
by Katsutoshi Itoh 27 Oct '11

27 Oct '11

hi. I try to convert yesod app 0.8.2 to 0.9.3. my app import Yesod.Helpers.Crud. migration guide say that 'Helpers' remove. so you mean Yesod.Crud? but couldn't find this module. tell me where this module gone?

2 1

questions about ResponseEnumerator
by Kazu Yamamoto 24 Oct '11

24 Oct '11

Hello, I have two questions about ResponseEnumerator. 1) If Application opens a file Handle and uses enumHandle to return ResponseEnumerator, how does the Application close the Handle? 2) It seems to me that Warp pauses the timer while running Application. If we want to set timer to Application for security reasons, what is the best way to do so? Thanks. P.S. Background: a process of mighttpd sometime dies. I'm not sure but I suspect that the CGI part is doing something wrong. --Kazu

4 30

[Database.Persistent] Custom Id field
by Konstantin Litvinenko 23 Oct '11

23 Oct '11

Hi All. I want to access database in a project where almost all objects has primary keys named idx, not Id. How can I define persistent object with key idx not Id? Another problem is that idx is not serial, just integer, and must be set explicitly. Is persistent capable for such tasks?

2 1

Initial SSL support for Warp
by Michael Snoyman 23 Oct '11

23 Oct '11

Hi all, Thanks (once again) to Vincent's awesome tls package, I've just added experimental support to Warp for SSL connections. The basic idea is to create an abstraction within Warp called a Connection, which handles sending and receiving data. This abstraction provides for vectored and non-vectored I/O, as well as enumerator-based I/O. In other words, it supports all of the features Warp already uses. Then a separate package, warp-tls, provides an alternate way of creating a Connection that uses the tls package instead of a raw socket. I've put this code up in a separate branch[1]. The one piece of the puzzle most definitely not implemented yet is proper timeout support. I'm waiting till Kazu and I come up with some clarity on the recent slowloris discussion before implementing the timeout code for tls. Also, I'm sure some thing could be more efficient, but it's certainly working. I've included a pong.hs demo, as well as a self-signed private key and certificate, so in order to test this out, you should need to: 1. Clone the repo 2. "cabal install" warp 3. "runghc pong.hs" inside the warp-tls package Another change that likely makes sense is to improve the TLSSettings setup so it doesn't need to read the key and certificate from a file. I'm definitely open to other suggestions. Also, I don't have a particular use case for this right now, it was just something sitting on my TODO list and was relatively easy to implement, so I decided to take a crack at it. Michael [1] https://github.com/yesodweb/wai/tree/warp-tls

3 5

http-enumerator : Issue with chunked encoding and rawBody
by Erik de Castro Lopo 17 Oct '11

17 Oct '11

Hi all, I've been working on simple HTTP proxy written using Warp, Wai and http-enumerator. This had led to a number of patches being pushing into the last of those 3 packages. This proxy is supposed to be a pure pass through for which I added the rawBody field to the http-enumerator Response data type. However I have now figured out that while this does work for Gzipped data it doesn't work for data with transfer-encoding set to chunked. The symptom of 'not working' is that any client which tries to pull data from a server that serves up chunked data just hangs and eventually times out. This happens both with a client written using http-enumerator and with wget. Digging around a bit in the http-enumerator sources I find this: let body' x = if not rawBody && ("transfer-encoding", "chunked") `elem` hs' then joinI $ chunkedEnumeratee $$ x else case mcl >>= readMay . S8.unpack of Just len -> joinI $ takeLBS len $$ x Nothing -> x The problem seems to be with the "Nothing -> x" case. As an experiment I replaced that last line with: Nothing -> joinI $ chunkedEnumeratee $$ x which solves the hang/timeout, but means the data received by the client is no longer chunked even though the header says it should be. I therefore think I need something like: Nothing -> joinI $ chunkedPassthuEnumeratee $$ x which requires a new Enumeratee that reads chunked data and passes it on still chunked. Basically something with a signature like this: chunkedPassthruEnumeratee :: MonadIO m => Enumeratee S.ByteString S.ByteString m a Does this make sense or am I missing a much easier way to do this? Cheers, Erik -- ---------------------------------------------------------------------- Erik de Castro Lopo http://www.mega-nerd.com/

1 1

A WebSocket library
by Jasper Van der Jeugt 05 Oct '11

05 Oct '11

Hello all, I have been working on a WebSocket [1] library lately, which you can find here [2]. It's getting to the point at which I want to release it on Hackage. However, there is one thing remaining before the library will be really useful for applications: integration. I would like to provide integration with Happstack, Snap and Yesod -- this is why I have built the library around the enumerator package [3]. It would be awesome if frameworks could more or less agree on a way in which an HTTP connection can be "transformed" to a WebSocket. That way, I will be able to provide packages such as `websockets-warp`, `websockets-snap` etc. Currently, the "entry point" of the websockets library is the following function: runWebSockets :: WebSockets a -> Enumerator ByteString IO a -> Iteratee ByteString IO () -> Iteratee ByteString IO a Where the first argument is the user-supplied code in the `WebSockets` monad (needs to keep a bit of state etc.), the second argument is an enumerator which the library can use to read from the socket, and the last argument is an iteratee with which the library can write to the socket. A web server then needs to provide some way to get this enumerator/iteratee pair, and hand it over to the library (currently, this is lacking). Some more details apply, e.g. the web server shouldn't kill the websocket handler as fast as regular HTTP connections. Is this proposal somewhat agreeable? I'm open to any feedback. [1]: http://en.wikipedia.org/wiki/WebSocket [2]: http://github.com/jaspervdj/websockets [3]: http://hackage.haskell.org/package/enumerator Cheers, Jasper

7 11

HEADS-UP: security fix, please upgrade clientsession to >= 0.7.3.1
by Felipe Almeida Lessa 03 Oct '11

03 Oct '11

Hello! Please be advised that clientsession < 0.7.3.1 is vulnerable to timing attacks [1]. We have just released a fix and it's already on Hackage [2]. We advise all users of clientsession (and, consequently, Yesod) to upgrade as soon as possible to a version >= 0.7.3.1. With a timing attack a malicious user may be able to construct a valid MAC for his message. However, the attacker is not able to recover the MAC key or the encryption key. So you don't need to change your keys, just upgrade ASAP. Cheers, =) [1] https://github.com/snoyberg/clientsession/pull/4 [2] http://hackage.haskell.org/package/clientsession-0.7.3.1 -- Felipe.

1 1