- web-devel - Haskell.org

Re: [web-devel] [Haskell-cafe] no Web-Security component in Haskell?
by Thomas Koch 23 May '15

23 May '15

// moving the question with more info from haskell-cafe to web-devel Hallo, I already wrote a message with the same subject to haskell-cafe without reply. I did not found anything comparable to Spring Security[1][2] (Java) or Symfony Security[3] (PHP) in Haskell. Both components are used in web applications to grant or deny access to resources based on roles, ACLs or custom voters. [1] http://projects.spring.io/spring-security [2] http://docs.spring.io/autorepo/docs/spring-security/3.1.7.RELEASE/apidocs [3] http://api.symfony.com/master/Symfony/Component/Security/Core/SecurityConte… A naive strategy would be to port the concepts of both components, which are very similar, to Haskell. They represent a lot of accumulated knowledge from many experts about web security. Or are there better ways to do web security in a powerful language like Haskell? There was some unfinished role-based-access-control effort in snap[4] that has been removed from git now. [4] https://groups.google.com/forum/#!topic/snap_framework/yUgSEVpP2GE There seem to be a more modern (and more complex) thing than Role-Based- Access-Control now, XACML[5] which is used inside Red Hats JBoss[6]. [5] http://en.wikipedia.org/wiki/XACML [6] http://picketlink.org/about Regards, Thomas Koch

1 0

ANN: nonce package
by Felipe Lessa 22 May '15

22 May '15

(Please forgive me if you received multiple copies of this e-mail.) Hello, The nonce package [1] contains functions to easily generate cryptographic nonces for many situations. Some places where these generated nonces can be used include: - Password recovery e-mail tokens. - XSRF protection tokens. - Session IDs sent on cookies. - Initialization vectors. It uses an AES CPRNG periodically reseeded from /dev/urandom (or equivalent). It has no frills, no knobs, so it's hard to misuse. It's been available for an year but I just realized I've never properly announced it. Regrettably, I've seen many uses of the random package (System.Random) when generating nonces. It's a bad choice: it is not a cryptographically secure PRNG, contains low entropy (64-bit state), and its default usage is seeded predictably (using a constant seed). Please avoid using the random package for generating nonces at all costs. In its stead, use the nonce package or something similar. Cheers, [1] http://hackage.haskell.org/package/nonce -- Felipe.

1 0

Monad transformers with Warp/WAI
by Alex 16 May '15

16 May '15

Hello: I am writing a small application which receives HTTP requests, translates them to JSON, and queues the requests using RabbitMQ. I created a Monad transformer stack (ReaderT AppConfig IO a) to carry around my application configuration and AMQP connection handle (MVar Connection within AppConfig), but I am having difficulty determining how to integrate it with my Warp application. The function which is responsible for accepting Requests and returning Responses (app :: Application) needs to call functions which require AppConfig. For example: (sendToRabbitMQ :: RPCRequest -> MyApp ByteString) is a blocking call which requires the AMQP connection handle found within AppConfig, which is why it returns a MyApp ByteString as opposed to a IO ByteString. If I want to call `sendToRabbitMQ' from `app', then the type of `app' needs to change from Application to something else, but I am not sure what that should be. What's the best way to proceed? -- Alex

2 3

Yesod Mform and hamlet
by K Sai Anirudh 25 Apr '15

25 Apr '15

Hi, I am new to yesod and following the documentation to make a form. In the documentation the form template was created in .hs file itself. But I have a separate hamlet where I want to customize. I want to access "fields" in my hamlet file. The expected type of 'generateFormPost' is (xml, Enctype) . Can anybody tell me what I should be returning from 'tableMform extra' . I think it should be in xml format. But I think I should not be using toWidget as in below example of documentation. tableMform extra = do fields <- forM lis (\(w,h) -> mopt intField "this is not used" (Just h) ) return (fields) ---I know this line has the type error. Can anybody suggest how to deal with it {- --I am referring this code from yesod website to make my form. In this it was using runFormGet, but I want use generateFormPost and moreover it was creating a widget which is used in displaying the website. I don't want to create the widget here but in my hamlet file where the 'fields' is accessed via interpolation. personForm :: Html -> MForm Handler (FormResult Person, Widget) personForm extra = do (nameRes, nameView) <- mreq textField "this is not used" Nothing (ageRes, ageView) <- mreq intField "neither is this" Nothing let personRes = Person <$> nameRes <*> ageRes let widget = do toWidget [lucius| ##{fvId ageView} { width: 3em; } |] [whamlet| #{extra} <p> Hello, my name is # ^{fvInput nameView} \ and I am # ^{fvInput ageView} \ years old. # <input type=submit value="Introduce myself"> |] return (personRes, widget) -} getHomeR :: Handler Html getHomeR = defaultLayout $ do -- Generate the form to be displayed (fields, enctype) <- generateFormPost tableMform let (fires,fiview) = unzip fields $(widgetFile "layout") |] Please let me know if there is any misunderstanding. I have idea of how to get the form from the way done in the documentation, but I want to use a separate hamlet file, as I want to customize the look of the form. -- Thanks Sai Anirudh Kondaveeti

2 1

Re: [web-devel] proxy with wai
by Michael Snoyman 27 Mar '15

27 Mar '15

On Sun, Mar 22, 2015 at 10:01 AM Jos van den Oever <jos(a)vandenoever.info> wrote: > On Sunday 08 March 2015 07:28:30 you wrote: > > I've updated that Gist to be compatible with WAI 3.0. The basic changes I > > made were: > > > > 1. Change the way Warp settings are applied (no longer use record syntax, > > but explicit set* functions). > > 2. conduit is no longer the standard streaming interface for WAI, so > > imported Network.Wai.Conduit and used helper functions from there. > > 3. The specific question you asked about: the semantics for how to do > > resource allocation in an application have changed. There were some holes > > in the previous approach that allowed async exceptions to leak in at the > > wrong time. Instead, WAI 3.0 uses a similar interface to most resource > > allocation functions in Haskell (like bracket or withFile). Specifically, > > this looks like: > > > > > > HCl.withResponse req2 man $ \res -> do > > let body = mapOutput (Chunk . fromByteString) $ > > HCC.bodyReaderSource $ HCl.responseBody res > > headers = filter safeResHeader $ HCl.responseHeaders res > > respond $ responseSource (HCl.responseStatus res) headers body > > I'd like my proxy to be a caching proxy so each request shoule be saved to > a > file. I've tried adding an additional sink, (sinkFile) or conduit > (conduitFie) > to the HCC.bodyReaderSource, but cannot it right. What would be a good way > to > do this? > > > What have you tried so far? Michael

2 4

proxy with wai
by Jos van den Oever 21 Mar '15

21 Mar '15

Hello all, I'm studying the Yesod book by Michael Snoyman and I'm slowly coming to grips with Haskell for the web. My current goal is to write an http(s) proxy that does filtering and caching. I've found a nice example by Snoyman on github: https://gist.github.com/snoyberg/8779671 This code does not compile with wai >= 3 because that does not have responseSourceBracket any more. What is the best way to replace it? --- Wai.responseSourceBracket (HCl.responseOpen req2 man) (HCl.responseClose) $ \res -> do let body = mapOutput (Chunk . fromByteString) $ HCC.bodyReaderSource $ HCl.responseBody res headers = filter safeResHeader $ HCl.responseHeaders res return (HCl.responseStatus res, headers, body) ---- Best regards, Jos van den Oever

2 2

Payroll app
by Njagi Mwaniki 16 Feb '15

16 Feb '15

I am wondering how to go about having users create user accounts and then use those accounts to create payrolls. A payroll is a set of payslips associated with a certain user. What I currently have is an auth system that uses openID. I am thinking of associating a payroll and subsequently the payslips in the payroll with the email address of the currently logged in user but I am not sure how to go about that. Second, I don't want to limit users to the kind of allowances and deductions they can enter. So in the web form they are going to have a button they can use to add fields of a key value pair for example one can add an allowance field and add [House_allowance] [3000]. This will be part of a payslip. However, these extra fields can't be added to the Payslip type because the additional fields are added through JS. So I shall have a separate type `Extra` to store this map where `data Extra = Extra { Allowance:: [(Text, Int)], Deduction :: [Text, Int]}` I can convert this map to a PersistentValue in GHCI but I have no idea how to represent it in the config/models file. How can I show in my config/models that I want to store this map in the DB and associate it with the relevant payslip?

1 0

How to create Cassius Mixin?
by Antoni Boucher 14 Jan '15

14 Jan '15

Hello. How can I create a CSS mixin with Cassius (from Yesod Haskell Web Framework) ? For instance, this code: transition val = [cassiusMixin| -webkit-transition: #{val} -moz-transition: #{val} -ms-transition: #{val} -o-transition: #{val} transition: #{val} |] does not work because cassiusMixin does not exist. Is there a way to create a mixin with cassius? If not, is cassius a limited version of lucius? Thanks.

2 2

http2
by Kazu Yamamoto 21 Nov '14

21 Nov '14

Hi guys, I would like to announce the first release of the http2 package. http://hackage.haskell.org/package/http2 This package tries to implement the coming HTTP/2.0. HTTP/2.0 is being standardized in two internet-drafts: http://tools.ietf.org/html/draft-ietf-httpbis-http2-09 http://tools.ietf.org/html/draft-ietf-httpbis-header-compression-05 The current version of the http2 library implements the latter (called HPACK) only at this moment. I would like to make this library so that other HTTP libraries can use when supporting HTTP/2.0. Feedback is welcome. --Kazu

7 15

Re: [web-devel] [Haskell-cafe] Tutorial for creating haskell apps in the browser easy
by Alberto G. Corona 05 Nov '14

05 Nov '14

They are eating my brain already! 2014-11-05 14:37 GMT+01:00 Henk-Jan van Tuyl <hjgtuyl(a)chello.nl>: > > There is a good chance that you will be punished for eternity, that your > liver will be eaten daily by a monad. > > > On Wed, 05 Nov 2014 10:47:35 +0100, Alberto G. Corona < > agocorona(a)gmail.com> wrote: > > I feel like Prometheus, the semi-god that teach humans how to make fire, a >> privilege of the gods. >> >> Will I receive the wrath of the gods of Category Theory for revealing the >> secret? There will be an industrial Hercules? >> >> 2014-11-04 23:49 GMT+01:00 Alberto G. Corona <agocorona(a)gmail.com>: >> >> Hi >>> >>> Just in case you don´t noticed it, this is the first tutorial for >>> creating >>> Browser applications in Haskell for non haskellers. >>> >>> >>> http://www.airpair.com/haskell/posts/haskell- >>> tutorial-introduction-to-web-apps >>> >>> -- >>> Alberto. >>> >>> > -- > Folding@home > What if you could share your unused computer power to help find a cure? In > just 5 minutes you can join the world's biggest networked computer and get > us closer sooner. Watch the video. > http://folding.stanford.edu/ > > > http://Van.Tuyl.eu/ > http://members.chello.nl/hjgtuyl/tourdemonad.html > Haskell programming > -- > -- Alberto.

1 0