Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Would you build a pure client-side JavaScript App using Pageforest?

pageforest.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Would you build a pure client-side JavaScript App using Pageforest?

#11

Post by mckoss »

andrewjshults wrote: post #6

Possibly using the open source platform, fairly unlikely on a hosted version. Why? I think it's almost certain that at some point I'm going to need some configuration or tweaks to the server side code that are application specific and cannot be done in client side code (validation, heavy lifting or secret sauce things). As nice as it would be to not worry about the service side code, once you get past the basics of a…

Yes, we have our own user validation system (a challenge/response protocol). We actually validate you on the pageforest.com domain, and then transfer a session cookie to your application - so your app never sees the user password/secret.

I would say our sweet spot is smaller, document-centric apps (games, puzzles, document editors). Anything that can use a simple document persistence model.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#12

Post by mckoss »

rmason wrote: post #9
kazoolist wrote: post #7

Earlier quoted context omitted.

quoting: What Services does Pageforest Provide? Cloud-based Document Storage - Each Pageforest user is given storage for their own document collection in the Cloud. When a user authorizes your application, your App can create and store documents to the user's collection.

Document storage? Saving an html page to a directory could be document storage. They asked for comment and I think they need to be more specific that's all. If they're using the GAE db imho they should say so.

Good points. The back end is implemented on App Engine. But we provide an abstracted storage interface. Application can created "documents" (up to 1 MB of JSON, and saved using a HTTP PUT or POST). Our permissions model is based on the document - you can keep a document private to a user, or make it read/write able by others.

In addition, each document can have as many child "blobs" as you want (each blob is up to 1 MB using any format - can be text, png, json, xml, etc.).

Interestingly, each "App" is very similar to a "Document". E.g., you index.html file is a "blob" in the application.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#13

Post by mckoss »

ktsmith wrote: post #10
rmason wrote: post #4

I don't see any mention of database. If you can't save or retrieve records that's kind of limiting, no?

To walk a little further down that path, if there is database access how is validation done since none of the client code can be trusted to have been executed and all input from the client should be considered suspect?

User authentication is handled by the server, and then a session cookie is created on your application sub-domain.

App writers don't have to worry about authentication - just redirect the user to the www.pageforest.com/sign-in/appid page, and the will redirect back to the app if the user has granted the application permissions to save on their behalf (much like a 3-legged oAuth).

Re: Would you build a pure client-side JavaScript App using Pageforest?

#14

Post by mckoss »

rmason wrote: post #4

I don't see any mention of database. If you can't save or retrieve records that's kind of limiting, no?

Your JavaScript application uses a REST protocol, or, more usually, or client JavaScript storage wrapper:

http://wiki.pageforest.com/#pageforest-api/storage

Simpler apps will save their state in a document created for the user (up to 1 MB). But you can do more using the "Blob" storage interface.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#15

Post by mckoss »

jporta wrote: post #8
mckoss wrote: post #3

Earlier quoted context omitted.

Oops. Thanks - I'll correct that. Any elaboration on why this service would or would not appeal to you?

I don't see any obvious benefit in using it. Relying on the the platform to handle the user authentication and document storage is something I wouldn't be comfortable with, though I'd use it as an option (as facebook connect, google or any other authentication service out there). In general, I think this would have been a hit 5 years ago. Now, with services like heroku, phpfog, app engine, even github having free pla…

Good feedback. What I'm aiming for (and trying to see if there are others that this resonates with), is a higher level of abstraction for HTML5-centric application development.

There's a lot to learn to build applications that span database/web server/client - so I'm trying to build a "generic" backend, and let the application developer concentrate on the client side only.

Maybe it's really only applicable to "toy" or "prototype" applications. Like this one, for example:

http://wiki.pageforest.com/

Re: Would you build a pure client-side JavaScript App using Pageforest?

#17

Post by drcode »

I just want to say I have been wanting this forever and can't believe no one has provided this before- I'm annoyed you guys beat me to this type of product.

This is exactly how a web app should be created- All the apps I've been creating lately are 95% client-side javascript and 5% of annoying server code that could obviously have been implemented using a generic REST-based data store.

I will be using pageforest extensively (Assuming it's not buggy, etc :-) Hats off to you guys for being first to market on this!

Re: Would you build a pure client-side JavaScript App using Pageforest?

#18

Post by ktsmith »

mckoss wrote: post #13
ktsmith wrote: post #10

Earlier quoted context omitted.

To walk a little further down that path, if there is database access how is validation done since none of the client code can be trusted to have been executed and all input from the client should be considered suspect?

User authentication is handled by the server, and then a session cookie is created on your application sub-domain. App writers don't have to worry about authentication - just redirect the user to the www.pageforest.com/sign-in/appid page, and the will redirect back to the app if the user has granted the application permissions to save on their behalf (much like a 3-legged oAuth).

Thanks for the answer, but my question isn't about user authentication/validation but validation of input from the user into my application.

A simple example, I set up a survey app. Several of the questions contain user input in the form of dates or numbers such as, date of birth, number of years living in the united states, years employed, etc. To help weed out bogus answers I want the fields to be validated/filtered. Date fields should be dates, numeric fields should only contain digits. In a traditional client server app I can validate this on the client side before submission in javascript, but I would still need to validate it on the server side as the clients input cannot be trusted. There is no guarantee that the validation code was ever run, that the user didn't modify the code as/before it was executed or that the user didn't simply post bogus data via a script.

Much more importantly, if I'm taking user input and then pushing that data back into the page for other users to see how do I prevent someone from submitting malicious javascript that is then executed by the next users browser when they view the document? The pitch is that my application is 100% client side javascript so it would seem to preclude the vast majority of apps that I can even think of since the users input would need to be processed/validated server side before I would be willing to store it or make it available for others to consume.

Re: Would you build a pure client-side JavaScript App using Pageforest?

#19

Post by drcode »

jporta wrote: post #8
mckoss wrote: post #3

Earlier quoted context omitted.

Oops. Thanks - I'll correct that. Any elaboration on why this service would or would not appeal to you?

I don't see any obvious benefit in using it. Relying on the the platform to handle the user authentication and document storage is something I wouldn't be comfortable with, though I'd use it as an option (as facebook connect, google or any other authentication service out there). In general, I think this would have been a hit 5 years ago. Now, with services like heroku, phpfog, app engine, even github having free pla…

Sure, all those services let you write server code for free, but why write server code at all if you don't have to?

Re: Would you build a pure client-side JavaScript App using Pageforest?

#20

Post by drcode »

andrewjshults wrote: post #6

Possibly using the open source platform, fairly unlikely on a hosted version. Why? I think it's almost certain that at some point I'm going to need some configuration or tweaks to the server side code that are application specific and cannot be done in client side code (validation, heavy lifting or secret sauce things). As nice as it would be to not worry about the service side code, once you get past the basics of a…

Google App Engine (and other cloud providers) also places limits on how much you can tweak the server side code. Clearly, there will always be apps that require some crazy server-side C code or whatever, but for 99% of apps all that matters is whether pageforest has exposed enough in the API to take care of the important stuff (validation, etc.)

I'm not saying their API is good enough for this, since they just launched, but from a theoretical standpoint I think the concept is sound.

Post reply on HN