Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
ufarn
May 30, 2009

caberham posted:

Hi guys, I'm planning on making a basic portfolio site for a small business. If I want to dabble with Jekyll, should I just use netlify? It's a business to business type of company so there won't be too many hits and inquiries. The only tricky thing I'm reading about is form and email handling, but Netlify on the surface seems to handle forms as well. Whereas if I host on S3, I need to incorporate another email service like Mandrill?

Oh and some customers would be in China so what problems will I have dealing with the stupid FireWall?
If you want to go fully static, surge is really compelling.

Adbot
ADBOT LOVES YOU

caberham
Mar 18, 2009

by Smythe
Grimey Drawer
I just checked the link and it looks really compelling. Just from skimming the last 20 pages if I want to take this route, the best practices for me to follow is:

I wonder the difference between surge and netilfy? On a superficial level, paid version of netlify seems to be more automated

Sorry if I'm missing things out or dont have a clear big picture. I know basic Python, CSS, and HTML and learning things with treehouse account. I suppose I should just get my hands dirty and figure things out along the way? And is there a drawback to make my site very static compared to traditional dynamic Single Page APP? The website is about a small manufacturing company with a few product shots and machines. Previously there was a wordpress installation but updates were few and far between

ufarn
May 30, 2009
Depending on whether you need your VM:

code:
$ npm install -g surge # install
$ surge _site # sets up user and domain.surge.sh and uploads _site dir

Site available at domain.surge.sh
That’s basically how it works. You’ll have to implement your form yourself - possibly with a JS framework or something embeddable like Google Forms. That’s static websites for you.

Then you can create GitHub hooks to have your site update automatically, when you push updates to your repo.

What’s really awesome is that you can also create a password-protected website by creating an AUTH file with usernames and passwords.

I thought it was $13/m, period, but it looks like it’s per project, which is kinda silly, but really neat for not having to bother with S3 and CloudFlare.

ufarn fucked around with this message at 10:49 on Dec 7, 2015

chami
Mar 28, 2011

Keep it classy, boys~
Fun Shoe

caberham posted:

Hi guys, I'm planning on making a basic portfolio site for a small business. If I want to dabble with Jekyll, should I just use netlify? It's a business to business type of company so there won't be too many hits and inquiries. The only tricky thing I'm reading about is form and email handling, but Netlify on the surface seems to handle forms as well. Whereas if I host on S3, I need to incorporate another email service like Mandrill?

Oh and some customers would be in China so what problems will I have dealing with the stupid FireWall?

Make sure whatever CDN or web font services you are using are either allowed by the firewall or that you specify fallbacks. Google Web Fonts in particular.

Kekekela
Oct 28, 2004

caberham posted:

Hi guys, I'm planning on making a basic portfolio site for a small business. If I want to dabble with Jekyll, should I just use netlify? It's a business to business type of company so there won't be too many hits and inquiries. The only tricky thing I'm reading about is form and email handling, but Netlify on the surface seems to handle forms as well. Whereas if I host on S3, I need to incorporate another email service like Mandrill?

Oh and some customers would be in China so what problems will I have dealing with the stupid FireWall?

Report back if you use Netlify, I'm curious as I've used bit balloon (their original, free offering) before and definitely want to check it out at some point. I'd never heard of Surge, will definitely be checking that out.

Github pages might work for what you want to do, also.

Kekekela fucked around with this message at 16:15 on Dec 7, 2015

IAmKale
Jun 7, 2007

やらないか

Fun Shoe
I'm probably overthinking this, but are there any "static site generators" that will let me just sandwich some HTML files in between two other HTML "template" files, maybe with support for page hierarchy as the HTML files are stored in folders? I have a header and footer that I want to pre- and append to some boring informational pages so we can host our site on Github Pages. Right now I've got a really basic bash script that I run to cat everything together but it doesn't support anything deeper than a single directory because :effort:

And I've looked at Jekyll and Hugo but they both seem tailored for blog-type websites. I'll probably figure out how to use these for posting press releases and whatnot on our site. But for now I still haven't been able to figure out if they work for arbitrary HTML content between a standard header and footer.

Unity Gain
Sep 15, 2007

dancing blue
Jekyll doesn't *have* to be used for a blog. You can just use simple pages that aren't blog-like.

You can also embed plain old HTML files using

code:
{% include footer.html %}
This was taken directly from the Jekyll site:

http://jekyllrb.com/docs/templates/

Anony Mouse
Jan 30, 2005

A name means nothing on the battlefield. After a week, no one has a name.
Lipstick Apathy
I've been checking out Firebase and I'm liking what I see so far - generous free-tier features, built in user authentication, and a JSON-oriented database structure that appeals to my puny JavaScript-laden brain. Are there any caveats or gotchas that I should look out for as a naive front-end dev? I have no idea if their database-side, rules-based approach to authentication and access permissions is a stroke of genius, business as usual, or completely retarded.

ufarn
May 30, 2009

Karthe posted:

I'm probably overthinking this, but are there any "static site generators" that will let me just sandwich some HTML files in between two other HTML "template" files, maybe with support for page hierarchy as the HTML files are stored in folders? I have a header and footer that I want to pre- and append to some boring informational pages so we can host our site on Github Pages. Right now I've got a really basic bash script that I run to cat everything together but it doesn't support anything deeper than a single directory because :effort:

And I've looked at Jekyll and Hugo but they both seem tailored for blog-type websites. I'll probably figure out how to use these for posting press releases and whatnot on our site. But for now I still haven't been able to figure out if they work for arbitrary HTML content between a standard header and footer.
You only really need _config.yml file in your Jekyll project. Then you can either do this:

code:
<!— index.html —>
{% include top.html %}
Something something something
{% include bottom.html %}

<!—
    _layouts/
        top.html
        bottom.html
—>
or

code:
—
layout: mylayout
—
<!— index.html —>
Something something something
code:
<!— _layouts/mylayout.html —>

Top stuff
{{ content }}
Bottom stuff
After making those, you just hit `jekyll build`, and you’ll just get _site/index.html as output.

Jekyll is a static site generator; few if any of those projects are specifically tailored for blogging, but most usually support it natively.

(Sorry about the double and triple dashes; they automatically get converted on OS X.)

ufarn fucked around with this message at 09:26 on Dec 8, 2015

revmoo
May 25, 2006

#basta
Anyone know of a table library that does dynamically adding/removing columns?

streetlamp
May 7, 2007

Danny likes his party hat
He does not like his banana hat

Karthe posted:

I'm probably overthinking this, but are there any "static site generators" that will let me just sandwich some HTML files in between two other HTML "template" files, maybe with support for page hierarchy as the HTML files are stored in folders? I have a header and footer that I want to pre- and append to some boring informational pages so we can host our site on Github Pages. Right now I've got a really basic bash script that I run to cat everything together but it doesn't support anything deeper than a single directory because :effort:

Two people above probably got this covered for you but here's a link to a fairly simple static generator I use at work for prototyping mostly using grunt and grunt-includes

https://github.com/VCUarts/bp

McGlockenshire
Dec 16, 2005

GOLLOCKS!

revmoo posted:

Anyone know of a table library that does dynamically adding/removing columns?

Are you talking about front-end library here?

If so, you might not need a library for this. If the columns are already in the table and you just want to show/hide them, you can use CSS selectors in table-level classes to toggle visibility on columns of equal cells in each row easily using :nth-child(). Rows with unequal rowspans will screw this up, as it operates on the child of the tr, not the actual column.

McGlockenshire fucked around with this message at 23:27 on Dec 9, 2015

nexus6
Sep 2, 2011

If only you could see what I've seen with your eyes
I'm being put on a project that will essentially need to be a webapp/HTML & JS game that
  • can be used on an iPad or a larger touchscreen monitor
  • can store data entered into fields in the app
  • can store the score achieved in the game
  • can (given an internet connection) upload stored data
  • can (given an internet connection) download data (e.g. previous game scores)
  • can work offline

Basically this will be used at various field events around the country at different dates. At the end of the campaign the best score will be picked for prizes.

The game part isn't an issue because I have found an example on codecanyon that I can use.

Annoyingly the client can't guarantee that there wll be a live internet connection when people are playing the game so I can't write scores directly into a database.

I've kind of achieved this sort of thing previously by serializing data and storing it in localStorage. Later (when online) I'd have an 'Upload' button that sends all the localStorage data via AJAX to a server script to write into the database.

It was a real pain to set up and because I don't have a Mac I can't view the contents of an iPad's localStorage nor view the error console.

Does anyone have a better way to solve this issue? I'm afraid the only alternative I have to doing this is quitting my job and if I ever have to do something like this again it will be a real option.

I'm not an iOS developer! Stop pitching offline iPad apps!

Skandranon
Sep 6, 2008
fucking stupid, dont listen to me

nexus6 posted:

I'm being put on a project that will essentially need to be a webapp/HTML & JS game that
  • can be used on an iPad or a larger touchscreen monitor
  • can store data entered into fields in the app
  • can store the score achieved in the game
  • can (given an internet connection) upload stored data
  • can (given an internet connection) download data (e.g. previous game scores)
  • can work offline

Basically this will be used at various field events around the country at different dates. At the end of the campaign the best score will be picked for prizes.

The game part isn't an issue because I have found an example on codecanyon that I can use.

Annoyingly the client can't guarantee that there wll be a live internet connection when people are playing the game so I can't write scores directly into a database.

I've kind of achieved this sort of thing previously by serializing data and storing it in localStorage. Later (when online) I'd have an 'Upload' button that sends all the localStorage data via AJAX to a server script to write into the database.

It was a real pain to set up and because I don't have a Mac I can't view the contents of an iPad's localStorage nor view the error console.

Does anyone have a better way to solve this issue? I'm afraid the only alternative I have to doing this is quitting my job and if I ever have to do something like this again it will be a real option.

I'm not an iOS developer! Stop pitching offline iPad apps!

LocalStorage is pretty much all you can go on, the browser doesn't really have any other options for storage. How is the game loaded into the browser if there is no internet connection? Is it purely from cache, or is a web server installed on the client device to serve up the HTML/JS assets? If so, you COULD embed a REST API into that web server that lets you store things into some sort of SQLite, but this isn't really that different from LocalStorage.

Are you using ServiceWorkers? You could look into that, though it is again just a sort of middle-man for these type of things, doesn't materially change what needs to be done.

IAmKale
Jun 7, 2007

やらないか

Fun Shoe

nexus6 posted:

Does anyone have a better way to solve this issue? I'm afraid the only alternative I have to doing this is quitting my job and if I ever have to do something like this again it will be a real option.

I'm not an iOS developer! Stop pitching offline iPad apps!
What about using something like PhoneGap? They have a storage API that appears to go above and beyond localStorage, probably exposing the device's support for SQLite: http://docs.phonegap.com/en/1.2.0/phonegap_storage_storage.md.html

Mind you I don't have any practical knowledge of PhoneGap so I'm not actually sure if it's feasible to go this route.

nexus6
Sep 2, 2011

If only you could see what I've seen with your eyes

Skandranon posted:

LocalStorage is pretty much all you can go on, the browser doesn't really have any other options for storage. How is the game loaded into the browser if there is no internet connection? Is it purely from cache, or is a web server installed on the client device to serve up the HTML/JS assets? If so, you COULD embed a REST API into that web server that lets you store things into some sort of SQLite, but this isn't really that different from LocalStorage.

Are you using ServiceWorkers? You could look into that, though it is again just a sort of middle-man for these type of things, doesn't materially change what needs to be done.

It's a HTML5 canvas game so I figure I can store all the assets offline on the iPads with cache manifest or whatever it's called now.

Karthe posted:

What about using something like PhoneGap? They have a storage API that appears to go above and beyond localStorage, probably exposing the device's support for SQLite: http://docs.phonegap.com/en/1.2.0/phonegap_storage_storage.md.html

Mind you I don't have any practical knowledge of PhoneGap so I'm not actually sure if it's feasible to go this route.

I have looked at phoneGap a few times but I don't have a lot of experience with it. I'd rather build something with it in some free time and get confident with it before promising to use it in a project.

Munkeymon
Aug 14, 2003

Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.



nexus6 posted:

I have looked at phoneGap a few times but I don't have a lot of experience with it. I'd rather build something with it in some free time and get confident with it before promising to use it in a project.

The Application Cache has been deprecated in favor of Service Workers https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers (which are not well supported http://caniuse.com/#feat=serviceworkers).

If you need offline support PhoneGap is probably your only viable long-term bet.

IAmKale
Jun 7, 2007

やらないか

Fun Shoe
Thanks to an epiphany last night I finally figured out how to make a multilingual static site using Hugo. Now I have two versions of my site, one at /en/ and one at /jp/.

Now I'm stuck on where I should set up a redirect that defaults requests to the English site. With the current site structure there's no index.html at / - instead it's at either /en/index.html or /jp/index.html. What I want to do is send someone who visits us at http://site.com to http://site.com/en/. Would this best be accomplished as an NGINX 302 redirect?

ufarn
May 30, 2009

Karthe posted:

Thanks to an epiphany last night I finally figured out how to make a multilingual static site using Hugo. Now I have two versions of my site, one at /en/ and one at /jp/.

Now I'm stuck on where I should set up a redirect that defaults requests to the English site. With the current site structure there's no index.html at / - instead it's at either /en/index.html or /jp/index.html. What I want to do is send someone who visits us at http://site.com to http://site.com/en/. Would this best be accomplished as an NGINX 302 redirect?
You want the hreflang attribute.

LargeHadron
May 19, 2009

They say, "you mean it's just sounds?" thinking that for something to just be a sound is to be useless, whereas I love sounds just as they are, and I have no need for them to be anything more than what they are.
I'm at my wits' end with an IE problem, hoping someone here can help me out. I have some external SVG files that I'm embedding in my page. The solution I chose for this was to use jQuery to stick the SVG file contents into the DOM, so I could style them as I please with my external CSS. This works great in Chrome, Firefox, Opera, and Safari, but IE refuses to scale them. I figured I'd try out some other methods, but I'm not having much luck:

<img> tag to embed SVG
Neat, now my SVGs scale properly in every browser. But now I can no longer use my external CSS to style them. I tried to put CSS directly into one of the SVGs, like so:

code:
  <defs>
    <style type="text/css"><![CDATA[
        @font-face {
            font-family: "mycustomfont";
            src: url("../fonts/mycustomfont.eot?#iefix") format("embedded-opentype"),
                    url("../fonts/mycustomfont.woff") format("woff"),
                    url("../fonts/mycustomfont.otf") format("opentype");
        }
         
        svg {
            width: 90%;
            height: 90%;
        }
        g text {
            font-family: "mycustomfont", sans-serif;
            text-transform: uppercase;
            font-size: 28px;
            fill: white;
        }
     ]]></style>
  </defs>

Everything works except for the font, and that part is crucial. So, I tried a different method:

<object> tag to embed SVG
Same problem as the original. IE won't scale it, but my external CSS works great.

So any ideas, on either the scaling problem, or on the proper use of custom fonts in SVG embedded stylesheets?

Maluco Marinero
Jan 18, 2001

Damn that's a
fine elephant.

Munkeymon posted:

The Application Cache has been deprecated in favor of Service Workers https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers (which are not well supported http://caniuse.com/#feat=serviceworkers).

If you need offline support PhoneGap is probably your only viable long-term bet.

In what way has ApplicationCache been deprecated? It's true no new spec work is done on it, but it stores assets just fine, and supplemented with indexeddb for dynamic data support is just fine for any browser classed as modern.

Kekekela
Oct 28, 2004

Maluco Marinero posted:

In what way has ApplicationCache been deprecated?

https://developer.mozilla.org/en-US/docs/Web/HTML/Using_the_application_cache

nexus6
Sep 2, 2011

If only you could see what I've seen with your eyes

What the hell? So Application Cache 'may break at any time' but Service Workers aren't broadly supported? What are you supposed to do?

The project I'm working on will only be used few a few months next year and I'll instruct people not to update the devices the app is running on.

Maluco Marinero
Jan 18, 2001

Damn that's a
fine elephant.

Man, that is such weak bullshit by browser vendors. Why'd they have to deprecate a file store with no well supported alternatives to the process. I get massive Microsoft vibes from this sort of stuff, this isn't a responsible way to lead the pack.

Application Cache works, I've used it, sure it has limited usage, but in that limited usage space it works and is well supported. Service Workers may be good, but until it's properly supported by browsers properly who cares. Offline web will never take off the way the vendors treat it.

obstipator
Nov 8, 2009

by FactsAreUseless
Application cache was deprecated because its design is flawed and ends up causing headaches for a lot of its wanted use cases. http://alistapart.com/article/application-cache-is-a-douchebag

Maluco Marinero
Jan 18, 2001

Damn that's a
fine elephant.
I've read the article, it's a constant case of square peg round hole. Sure, it'd be good if it could do all the things service workers will be able to do, but for the simple case of storing offline assets for a web app it's usable. I guess it's not bad as long as no browsers end up in a state where they don't properly support either service workers or application cache.

The enthusiasm I've seen for dismantling things without a completely committed to replacement is kind of disappointing, mainly because it feels like application storage and delivery is the last place where you want to be constantly searching for new shiny. There is some places where it'd be nice to see stable commitment.

Munkeymon
Aug 14, 2003

Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.



nexus6 posted:

What the hell? So Application Cache 'may break at any time' but Service Workers aren't broadly supported? What are you supposed to do?

The project I'm working on will only be used few a few months next year and I'll instruct people not to update the devices the app is running on.

Oh, then you're probably fine. I'd be really surprised if they broke it within ~5 years and mildly within 5->10.

my bony fealty
Oct 1, 2008

I have a small web app written in React and the people I'm making it for are talking about wanting a mobile native app version.

Anyone have recommendations for a preferred option here? Meteor and React Native both look like they'll do it. There's not a lot of data involved, just one JSON file that will remain mostly static with possible updates in the future, so Meteor might be overkill.

It also currently relies on QR codes to direct people to specific sections of the app, which works ok but we're looking for another solution because nobody likes QR codes, not sure if that impacts native functionality.

my bony fealty fucked around with this message at 18:09 on Dec 11, 2015

Opulent Ceremony
Feb 22, 2012
Does anyone have experience using ua-parser (https://github.com/ua-parser)? I'm using it via the logstash useragent filter for our portal's analytics done with ELK and I'm not really happy with its results.

The default installation for that logstash filter seemed incapable of parsing IE below version 11, instead calling those 'Other'.

I noticed a pull request on the logstash filter GitHub project claiming the regexes.yaml from ua-parser being used in the latest version was actually outdated, so I grabbed the newest one from ua-parser core to use in place: Older IE versions are still incorrectly parsed, plus now I've got a ton of Chrome Frame that can't be right.

I'm hoping someone knows a better version of regexes.yaml or a better way to interpret useragent strings I can apply within the ELK pipeline somewhere.

Chenghiz
Feb 14, 2007

WHITE WHALE
HOLY GRAIL

nexus6 posted:

I'm being put on a project that will essentially need to be a webapp/HTML & JS game that
  • can be used on an iPad or a larger touchscreen monitor
  • can store data entered into fields in the app
  • can store the score achieved in the game
  • can (given an internet connection) upload stored data
  • can (given an internet connection) download data (e.g. previous game scores)
  • can work offline

(...)

Does anyone have a better way to solve this issue? I'm afraid the only alternative I have to doing this is quitting my job and if I ever have to do something like this again it will be a real option.

I'm not an iOS developer! Stop pitching offline iPad apps!

Your solution sounds fine. Application cache will handle caching your files offline quite well, as long as you get used to the way it works. localStorage has a 5MB limit on most browser/device combos and that's a lot of JSON. If you need more than that, look into pouchdb's client-side library for good cross-browser database functionality.

For pretty much everything other than UI testing you can develop in Chrome on your machine and emulate various levels of network connectivity as needed. I do a lot of web application development for iDevices in this way, and I rarely need to hook an iPad up for debugging anymore.

huhu
Feb 24, 2006
loving, :woop:. I figured out that it had to convert every "city, country" pair to lat/long. Ended up just finding some wep app to convert all of them once. Loads in about 1s now.



I've got a Google map here: https://goo.gl/XgteVU which is pretty much just code from https://developers.google.com/chart/interactive/docs/gallery/map#adding-multiple-marker-sets

Except that I've added in the following two bits of code:

code:
var jsonTable;
$.ajax({
     url: "js/projects-table.json",
     dataType: 'json',
     async: false,
     success: function(data) {
          jsonTable = data;
          console.log(jsonTable);
     }
});

To grab all the content from a json file to be displayed on the map.

code:
for (var i=0; i<jsonTable.length; i++){
     data.addRow([
          jsonTable[i].city + ", "+ jsonTable[i].country,
          "<b>Title: </b>" + jsonTable[i].name 
               + "<br><b>Sector: </b>" + jsonTable[i].sector 
               + "<br><b>Description: </b>" + jsonTable[i].description 
               + "<br><b>City: </b>" + jsonTable[i].city 
               + "<br><b>Country: </b>" +jsonTable[i].country,
          jsonTable[i].sector]);
}
And this to format the content to be displayed on the page.

I can't figure out though, why with the addition of this code, the webpage is taking so long to load.

Also, if anyone has a link for a guide on how to read the network activity recorder for Chrome developer link that'd be great. I have no idea how to search that without pulling up a bunch of irrelevant stuff.

huhu fucked around with this message at 22:23 on Dec 12, 2015

nexus6
Sep 2, 2011

If only you could see what I've seen with your eyes

Chenghiz posted:

Your solution sounds fine. Application cache will handle caching your files offline quite well, as long as you get used to the way it works. localStorage has a 5MB limit on most browser/device combos and that's a lot of JSON. If you need more than that, look into pouchdb's client-side library for good cross-browser database functionality.

For pretty much everything other than UI testing you can develop in Chrome on your machine and emulate various levels of network connectivity as needed. I do a lot of web application development for iDevices in this way, and I rarely need to hook an iPad up for debugging anymore.

Cool, I was just checking I wasn't doing anything dumb or missing out on a better way to do it. Meteor and PouchDB both appear to offer automatic syncing but I guess in my case it's not a huge deal if it doesn't sync magically by itself.

I just get really paranoid about this sort of thing because offline apps are out of my hands once they're in use and if anything goes wrong there's not a lot I can do. I once made a tiny syntax error in one project and they basically had to stop using the iPads until they were shipped back to me and I realized there was an errant ' character.

That and the fact that the people ultimately using these things aren't reliable and tell me they've uploaded more data than is actually in the database. I get blamed because they aren't counting correctly.

Skandranon
Sep 6, 2008
fucking stupid, dont listen to me

nexus6 posted:

Cool, I was just checking I wasn't doing anything dumb or missing out on a better way to do it. Meteor and PouchDB both appear to offer automatic syncing but I guess in my case it's not a huge deal if it doesn't sync magically by itself.

I just get really paranoid about this sort of thing because offline apps are out of my hands once they're in use and if anything goes wrong there's not a lot I can do. I once made a tiny syntax error in one project and they basically had to stop using the iPads until they were shipped back to me and I realized there was an errant ' character.

That and the fact that the people ultimately using these things aren't reliable and tell me they've uploaded more data than is actually in the database. I get blamed because they aren't counting correctly.

If this is being deployed to actual customers, there should probably be a formal QA process before it actually gets to them. Bugs are inevitable, you have to plan for that. "Ship it and let the customers do QA" is not a great plan.

Thermopyle
Jul 1, 2003

...the stupid are cocksure while the intelligent are full of doubt. —Bertrand Russell

Skandranon posted:

If this is being deployed to actual customers, there should probably be a formal QA process before it actually gets to them. Bugs are inevitable, you have to plan for that. "Ship it and let the customers do QA" is not a great plan.

Hey, it works for Google! :D

nexus6
Sep 2, 2011

If only you could see what I've seen with your eyes

Skandranon posted:

If this is being deployed to actual customers, there should probably be a formal QA process before it actually gets to them. Bugs are inevitable, you have to plan for that. "Ship it and let the customers do QA" is not a great plan.

AHAHAHAHAHA

:smith:

IAmKale
Jun 7, 2007

やらないか

Fun Shoe
Does anyone have experience piping a Wordpress-powered site through CloudFlare? Our news site was taken down early last month due to an overwhelming amount of traffic from some Russian IP address, and I'm thinking this might be a good excuse to put up behind CF's CDN.

And does anyone else know whether CloudFlare's "Full" level of SSL support allows you to verify your self-signed certificate with them? If not, wouldn't that open you up to MITM attacks? I mean, for $10/yr (or however cheap NameCheap certs are) it's almost not worth finding out, but I couldn't find anything in CF's docs detailing the self-sign route.

McGlockenshire
Dec 16, 2005

GOLLOCKS!
A big thing to know about CloudFlare is that they generally do not cache HTML content.

The value in their DOS protection is entirely in their existing blacklist and their bot detection heuristics. It's still quite possible for malicious activity to hit your site through them if the request doesn't otherwise set off alarms. The danger is that if you turn their detection up all the way, you begin to impact normal users.

I don't know if they support or alert on self-signed certificates, but keep in mind that there's nothing about an SSL certificate that prevents you from installing it in multiple places. We use the same cert to serve from CloudFlare and to CloudFlare.

YO MAMA HEAD
Sep 11, 2007

One of my projects at work involves uploading audio and then being able to annotate segments on a website. The main site is done in CodeIgniter, which is a decision I will be happy to revisit when I'm not the only developer on the job.

I've written a very slick web app that records audio, transcodes to Vorbis, stores it in IndexedDB, and eventually uploads to the main site using FormData. Initially, auth between the two was done in hacky way where the recorder just started its own CodeIgniter session on the main site and used the same URL endpoints as a normal user, but I've been working on implementing a proper RESTish API with OAuth2 for this and other potential add-ons. The recorder still mostly works in the client but now has a tiny Lumen backend to handle the password grant OAuth flow, CSRF, and some basic encryption.

It's working pretty well and is a big improvement over the old system, but I'm stuck when it comes to the file upload. Since requests now move through Lumen rather than directly to the main site, how do I think about my upload destination? Some good and bad possibilities:
  • Reimplement the access token (+ refresh token?) flow on the client and make requests directly to the main CI site (sounds like a bad idea and misses the point of the client secret on the server).
  • Upload to the Lumen server and then upload that file to the main site.
  • Upload to the Lumen server and instruct the main site to download the file.
  • Use the Lumen server to make an authenticated request to the main CodeIgniter site and receive a temporary upload endpoint, possibly linked to the access token. Return that path to the client and upload the FormData as with the original client-only app.

Obviously something like the last one is what I'm hoping will work; avoiding data on the Lumen server is an added bonus w/r/t HIPAA. Any thoughts?

v1nce
Sep 19, 2004

Plant your brassicas in may and cover them in mulch.
What's the problem with the Client-side being given the OAuth access token so they can upload directly to the API?

Definitely don't rewrite the flow to expose the client id or client secret. OAuth still needs back-end client validation stuff or you break all the security.
Uploading to Lumen at all should hopefully be an avoidable step.

If you do option 4 you're just implementing an even more granular token-based ACL.. and while that sounds dumb at first glance, if you're actually creating a placeholder receptacle for an uploadable file - like you're saying, "here's your bin. Put your audio file here" - it kinda makes good, logical workflow sense.

Adbot
ADBOT LOVES YOU

YO MAMA HEAD
Sep 11, 2007

In the interest of implementing as much OAuth as possible without fully understanding why, I'm using a short-lived access token that's exposed to the client and a refresh token that's encrypted by the Lumen server and kept in an HTTPOnly cookie. Currently my API requests pass from the client through Lumen to the API so that the refresh flow can automatically happen in middleware, but I'm not sure how much sense that makes now that I think about it—I end up making two routes for each API resource, one of which (Lumen) doesn't do anything but hit the actual API server . Should the client use its access token to directly hit the API and only call out to Lumen if it needs a fresh access token? If that's the case, uploading directly to the API would be more obvious.

YO MAMA HEAD fucked around with this message at 18:03 on Dec 16, 2015

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply