seaside-dev August 2022

seaside-dev@lists.squeakfoundation.org

6 participants
4 discussions

CSP support
by Philippe Marschall 28 Aug '22

28 Aug '22

Hi I'm looking into what it would take to make CSP work "out of the box". There are two different approaches: 1. Get rid of all of your inline scripts This mostly affects the load scripts. This can not easily be solved with a custom script generator. The issue here is that the load scripts are added during rendering of the body and we have to write the element in #close:on: of the script generator however at this point the load scripts aren't registered yet. We could register a mutable script generator here and add the load scripts to the document handler. This would mean a document handler per render continuation. It would also not cover cases where the user explicitly creates inline content. 2. Generate CSP nonces If we generate a CSP nonce [1] per render continuation and add it at the right places things should "just work". We could then run with default-src 'self' 'nonce-rAnd0m' And would have to add nonce="rAnd0m" to all your inline content (script, style, …). The issue here is this is quite invasive and affects all our head and body elements. We may have to introduce a new abstraction similar to script generator to make this work. [1] https://content-security-policy.com/nonce/ Cheers Philippe

1 1

Sound from seaside?
by tim Rowledge 26 Aug '22

26 Aug '22

I can't find any reference to being able to play sounds directly - ie not canned files but audio generated on the fly. Googling seems to mostly get me links to things like Radio Seaside (the town in california) and so on. I see the SUSound and the PTFactory>sound stuff but nothing that would appear to allow "webthing play: AbstractSound bachFugue" or similar. Am I missing someting obvious amongst the chaff? tim -- tim Rowledge; tim(a)rowledge.org; http://www.rowledge.org/tim Useful Latin Phrases:- Fac me cocleario vomere! = Gag me with a spoon!

2 3

How do you feel about the Ajaxifier?
by Philippe Marschall 25 Aug '22

25 Aug '22

Hello I recently stumbled upon WARenderPhaseContinuation >> #addRedirectedToHeader:. Which led me to ask myself whether somebody still uses the Ajaxifier. I see the following ways to continue: - Keep as is. - Factor out into a dedicated package and continuation class. - Remove Cheers Philippe

2 2

Seaside WebSockets (and what web servers adaptors are being used??)
by Johan Brichau 18 Aug '22

18 Aug '22

Hi all, I’m busy with (finally) adding dedicated websocket support to Seaside. It’s time to throw away the ajax polling or request streaming solutions we are using for this in Seaside applications ;-) The goal is to replace the functionality of Seaside-Comet with identical behavior but using websockets. The code in https://github.com/SeasideSt/Seaside/pull/1322 <https://github.com/SeasideSt/Seaside/pull/1322> is still experimental but working. i.e.: the examples in Seaside-WebSocket-Examples work in Pharo using the Zinc adaptor. So, if you are using Comet or websockets in your Seaside application, I’m interested in hearing your use cases so we can support them better in Seaside. I also recovered some work of Philippe from way back in 2010 who made a sample Seaside-WebSocket package using the WebClient webserver (see http://www.squeaksource.com/Seaside30Addons/ <http://www.squeaksource.com/Seaside30Addons/>). The code in that work intended for abstraction over different webservers for websocket support in Seaside. While I am now relying on Zinc’s WebSocket support to implement Seaside-WebSocket, I would still like to get the code in such a way that other webservers can also be used for the websockets in Seaside…. I think that is still the case but I have a hard time trying to test this with other webservers… I am only using Zinc in Pharo and GemStone and while looking at the state of the other supported web servers… well.. I wonder if Swazoo is still being used and if WebClient can even still be used in Pharo? I also have no insight into the web servers used in VAST or VW, so if anyone is interested in helping out to make the code portable from the start, please let me know. For the Squeak users: is http://ss3.gemtalksystems.com/ss/WebClient <http://ss3.gemtalksystems.com/ss/WebClient> still the primary location for the WebClient webserver in Squeak? It is what we are referring to in the BaselineOfSeaside3, but I wonder about that since there’s no update since many years… Cheers Johan

4 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

seaside-dev August 2022