What are the key similarities or differences between this and http://unhosted.org/ ? Considered collaborating?
Would you build a pure client-side JavaScript App using Pageforest?
21–30 of 43 posts
Re: Would you build a pure client-side JavaScript App using Pageforest?
#22Earlier quoted context omitted.
To walk a little further down that path, if there is database access how is validation done since none of the client code can be trusted to have been executed and all input from the client should be considered suspect?
User authentication is handled by the server, and then a session cookie is created on your application sub-domain. App writers don't have to worry about authentication - just redirect the user to the www.pageforest.com/sign-in/appid page, and the will redirect back to the app if the user has granted the application permissions to save on their behalf (much like a 3-legged oAuth).
[deleted]
Re: Would you build a pure client-side JavaScript App using Pageforest?
#23Earlier quoted context omitted.
User authentication is handled by the server, and then a session cookie is created on your application sub-domain. App writers don't have to worry about authentication - just redirect the user to the www.pageforest.com/sign-in/appid page, and the will redirect back to the app if the user has granted the application permissions to save on their behalf (much like a 3-legged oAuth).
Thanks for the answer, but my question isn't about user authentication/validation but validation of input from the user into my application. A simple example, I set up a survey app. Several of the questions contain user input in the form of dates or numbers such as, date of birth, number of years living in the united states, years employed, etc. To help weed out bogus answers I want the fields to be validated/filtere…
For your survey app example, why can't you just allow the client to submit bogus data if they want, then filter out the junk when you collect the data for reporting at the end? (This is assuming that the pageforest server doesn't implode when someone does this, but I see no reason to assume this would happen from a theoretical standpoint.)
For you second example, why the heck would you run javascript eval on the document data? As explained by mckoss, the storage format is JSON, not raw javascript that is executed. This is an important distinction: jQuery and other client libraries contain special commands for handling JSON that exist specifically to resolve the kinds of problems you are describing.
EDIT: It looks like the other reply explains that there is no "trusted agent", so this is clearly a limitation of their system (though not a theoretical limitation, as far as I can tell- No reason they couldn't allow the app creator to log in with pseudo-admin privlidges to do reporting.)
Re: Would you build a pure client-side JavaScript App using Pageforest?
#24Earlier quoted context omitted.
User authentication is handled by the server, and then a session cookie is created on your application sub-domain. App writers don't have to worry about authentication - just redirect the user to the www.pageforest.com/sign-in/appid page, and the will redirect back to the app if the user has granted the application permissions to save on their behalf (much like a 3-legged oAuth).
Thanks for the answer, but my question isn't about user authentication/validation but validation of input from the user into my application. A simple example, I set up a survey app. Several of the questions contain user input in the form of dates or numbers such as, date of birth, number of years living in the united states, years employed, etc. To help weed out bogus answers I want the fields to be validated/filtere…
It is true that you'd need to write your app so that you either segregate user's input (the only one reading a document is the original user who created it), or sanitize user-entered data in the client before displaying it.
I think this is pretty analogous to the traditional client/server model. The only difference is it all happens in the client.
There ARE cases where you need to aggregate data from multiple users, analyze it, and generate a summary, that are not very amenable to the Pageforest model - since there is no "trusted agent" that can execute that code.
Re: Would you build a pure client-side JavaScript App using Pageforest?
#25I just want to say I have been wanting this forever and can't believe no one has provided this before- I'm annoyed you guys beat me to this type of product. This is exactly how a web app should be created- All the apps I've been creating lately are 95% client-side javascript and 5% of annoying server code that could obviously have been implemented using a generic REST-based data store. I will be using pageforest exte…
Don't be hater ... come work with us! ;-)
Seriously, thanks for giving it a try - I'd love to get your feedback on problems you have using the platform...
Re: Would you build a pure client-side JavaScript App using Pageforest?
#26What are the key similarities or differences between this and http://unhosted.org/ ? Considered collaborating?
I agree there's definite overlap in their models, from the look of it- But there are still clear differences between these two concepts, with differing strengths and weaknesses.
Re: Would you build a pure client-side JavaScript App using Pageforest?
#27What are the key similarities or differences between this and http://unhosted.org/ ? Considered collaborating?
Thanks for the pointer to unhosted - I've not seen this before. Sounds like a standard protocol to separate application from data storage - pretty similar to the Pageforest model - except federated!
Re: Would you build a pure client-side JavaScript App using Pageforest?
#28Earlier quoted context omitted.
I don't see any obvious benefit in using it. Relying on the the platform to handle the user authentication and document storage is something I wouldn't be comfortable with, though I'd use it as an option (as facebook connect, google or any other authentication service out there). In general, I think this would have been a hit 5 years ago. Now, with services like heroku, phpfog, app engine, even github having free pla…
Sure, all those services let you write server code for free, but why write server code at all if you don't have to?
Because I can.
No, seriously, I didn't mean that server code should be written. You can use those services to serve static pages as well.
Re: Would you build a pure client-side JavaScript App using Pageforest?
#29Earlier quoted context omitted.
Thanks for the answer, but my question isn't about user authentication/validation but validation of input from the user into my application. A simple example, I set up a survey app. Several of the questions contain user input in the form of dates or numbers such as, date of birth, number of years living in the united states, years employed, etc. To help weed out bogus answers I want the fields to be validated/filtere…
For your survey app example, why can't you just allow the client to submit bogus data if they want, then filter out the junk when you collect the data for reporting at the end? (This is assuming that the pageforest server doesn't implode when someone does this, but I see no reason to assume this would happen from a theoretical standpoint.) For you second example, why the heck would you run javascript eval on the docu…
Why in the world would I want to collect garbage. Sure I can post process all of the survey data but it's trivial to do it on the front end so why not. In a significant number of other cases failing to validate input would simply be a non starter limiting this to toy apps.
As to the second point: Who said anything about _me_ running a javascript eval on user supplied data.
Go look at their wiki example click edit and in the text box type: alert('boo'); then click the hide button.
Notice two things. The first is that when you type the last > on the ending script tag the included script executes and you get the alert popup. When you reload the page you'll still see the alert('boo'); in the wiki display (in tags) but the tag is still live in the page as there's either no or very limited output sanitization. In a typical client/server application this is hopefully going to be sanitized or eliminated prior to ever being stored. The storage format is irrelevant if the data being stored is spit right back out into the page as in the wiki example.
Re: Would you build a pure client-side JavaScript App using Pageforest?
#30What are the key similarities or differences between this and http://unhosted.org/ ? Considered collaborating?
Thanks for the pointer to unhosted - I've not seen this before. Sounds like a standard protocol to separate application from data storage - pretty similar to the Pageforest model - except federated!
You're welcome! Glad to see you've already pinged the mailing list (I lurk).
Friday night networking! :-)