Circumventing browser same origin policy with a proxy in Rails 3 application - ruby-on-rails

I'm looking for a rails solution that can consume multiple remote XML services, passing dynamic request parameters and outputting the response as XML or JSON.
I've looked into TinyProxy (Can't get it to install on OSX via macports) and also Nginx. Nginx looks like it will do what I need and also give us flexibility going forward with load balancing etc.
Has anyone else got any experience of this? Any tried and tested solutions?

In stead of going through a proxy, one of the standard solutions around the same-origin policy is dynamic script tags and JSON callbacks.
For example: you page page wants to query an API at remotesite.com and you try to do an ajax call to http://remotesite.com/api?query=list but you get the same-origin error. To circumvent the restriction you could add a script tag to the DOM (using JS) that points to the url like this:
var e = document.createElement('script');
e.src = 'http://remotesite.com/api?query=list';
document.getElementById('fb-root').appendChild(e);
The browser would then run that request - the same thing you tried to do w/ an ajax call. Now the catch is that you need to have the response call one of your js functions w/ the data returned as a argument. So the request would return something like:
callbackFunctionname({...json_data_here...});
Now in your code you'd have a function like this:
function callbackFunctionname(json_string)
{
//you have result from cross domain ajax request.
}

Related

Jmeter: Dynamic URL encrypted

I'm working on a test plan with Jmeter.
The issue is that I can't retrieve the URL link as he is managed dynamically.
The URL has the following format:
localhost\blablabla?PATHPARAM=qzflh%2FGJHBGDCV%GROPJHVFFFDDFGGCFD%JJYTGVFRTVFGGFF%JUYGBG
I already try to search the value of PATHPARAM in the previous requests to retrieve it using regular expression extractor but I didn't find it.
It seems that this url is generated inside a javascript code but the way to extract it is unknown for me, inside the js code I find the value : var url = actionName + "?" + params ;
Is that any way to catch the content or the var url in Jmeter, else have you any other solution to solve this issue with this dynamic URL.
Many thanks in advance for your help.
I can see 2 possible options:
If you are being redirected to this URL automatically (you might need to play with Redirect Automatically and Follow Redirects boxes in the HTTP Request sampler
If this is the case - you should be able to get it using the following Regular Expression Extractor configuration
If you need to replicate the logic of this param variable calculation - you can attempt to do it using JSR223 PreProcessor which can execute arbitrary JavaScript code

retrieving full url with anchor in rails 3 and backbone

I have a url like this: /hello/world#/lol/backbone
I'd like to get access, in ruby, to the full, entire path. I'd normally do something like this: request.fullpath but that returns only /hello/world and leaves off the #/lol/backbone/
Been Googling for awhile. Can't seem to find it.
You can't get the fragment in your server code, the URL fragment (#/lol/backbone) is a client-side issue. The browser will interpret the fragment but it will not send it to your server.
If you need the fragment then you'll have to convert it to a parameter by intercepting your link with a bit of JavaScript, then the server could see something like
/hello/world?frag=/lol/backbone
and you could pull the fragment out of params[:frag]. This does of course assume that your JavaScript link interceptor will get run, that's not guaranteed so your server-side code should be prepared for a missing params[:frag].

How to do Soundcloud Auth Dance in JS with a Redirect_URL that has GET Params

** I am currently implementing fancy URLs to see if these 'solves' this. eg /me/soundcloudconnect rather than index.php?c=me&a=soundcloudconnect via mod_rewrite **
I have been using the Soundcloud JS SDK and SC.Connect() etc function(s) which automates much of the Auth process. I have been using a Normal html file: sc.html which worked fine and allowed me to get /me/ and /me/tracks etc.
However I now realise? that I will need to perform Auth myself as I need to add a State variable as documented below, so that it prepends these params to the end of the Redirect_URI.
http://groups.google.com/group/soundcloudapi/browse_thread/thread/7bddbc296f3b80af
The URL that I am trying to redirect back to is:
index.php?c=me&a=soundcloudconnect
which is the 'me' controller and 'soundcloudconnect' action.
So could someone please point me in the right direction?
Either I want to be able to use SC.Connect() etc (but also be able to get and save Token) as well as redirect back to the URI above
Or, I need to do the same thing (Auth and store token) but not using SC.Connect() but normal JS instead.
I read that Soundcloud Developer support is via Stackoverflow - so hopefully someone can help?
The normal HTML file with working SC Auth:
http://socialartist.co/sc.html
The dynamic page which does not work with SC Auth:
http://socialartist.co/index.php?c=me&a=soundcloudconnect#
The issue is probably that those query parameters are interfering with the original url. E.g. http://www.soundcloud.com/register/?token=blagha23412&redirect_uri=http://anydomain.com/index.php?c=me&a=soundcloudconnect
How would SoundCloud distinguish between your parameters and its parameters? You might be able to wrap the redirect_uri value in quotes.
An alternative might be to use the path as your parameters. E.g. http://anydomain.com/index.php/me/soundcloudconnect and then you should be able to grab whatever you need out of the path on your server.
** SOLVED!! **
If you need to pass parameters to SC connect/auth then the only way to do this is to setup fancy urls via mod_rewrite.
There 'seems' to be another method here, but you need to be doing the Auth in 2 steps and not via SC.Connect.
http://groups.google.com/group/soundcloudapi/browse_thread/thread/7bddbc296f3b80af
I was trying to get URL_redirect to work with:
index.php?c=me&a=soundcloudconnect
But in the End just used Fancy URLs which worked
http://socialartist.co/me/soundcloudconnect

Internal data post [Kohana 3.1]

In Kohana 3.1.x framework.
What are the benefits to send data with internal requests like this
$post = Request::factory('module/data')
->method(Request::POST)
->post(array('some' => 'random data'))
->execute()
->response;
if you could simply send data like this
Module::instance()->data(array('some' => 'random data'));
In this example Module is a random module and data is some random method.
I'll call this Module via ajax and internal requests. I'm planning to design RESTful API.
QUESTION IS: Why use HMVC instead of just directly using an internal class API
Because they're internal requests, there is no additional HTTP request being made.
You might want to take a look at Request_Client_Internal and compare it to Request_Client_External. After that you should feel enlightened :)
Edit:
You should know that AJAX requests aren't the only "external HTTP requests". cURL, PECL HTTP, file_get_contents() and other PHP functions will also send an external HTTP request (imho you should read the RFC 2616 to understand how HTTP actually works).
With HMVC calls you can use the same controller for both Ajax and internal requests. Also, it can handle a standard (non-ajax) http-requests, form submits for example. All-in-one solution, single entry point.
If you dont want HMVC calls, you will require one call for internal request (somewhere in base controller) and another one - in a special Ajax controller. Also you may have a problems with a data rendering (usually HMVC and ajax calls are using different templates). Its not DRY.
I would comment on the above, what biakaveron said, but I can't yet, so I put it as an answer.
#stacknoob: Could you use Module::instance()->data(array(...)) as controller's action? You could - with some extra code.
Instead, what biakaveron already said, you can keep your code logic and have the action return the same result for AJAX and HMVC requests. In one place. DRY + KISS.

Redirect 301 with hash part (anchor) #

One of our website has URL like this : example.oursite.com. We decided to move our site with an URL like this www.oursite.com/example. To do this, we wrote a rewrite rule in our Apache server that redirect to our new URL with a code 301.
Many websites link to us with URLs of the form example.oursite.com/#id=23. The problem is that the redirection erase the hash part of the URL with IE. As far as I know, the hash part is never sent to the server.
I wanted to implement the redirection with javascript to keep the hash part, but the Search Engine will not be aware that our URL changed. (no code 301 returned)
I want the Search Engine to be notified of our new URL(301) because we need to transfer the page rank to our new URL.
Is there a way to redirect with a 301 code and keep the hash part(#id=23) of in the URL ?
Search engines do in fact care about hash tags, they frequently use them to highlight specific content on a page.
To the question, however, anchor locations are unfortunately not sent to the server as part of the HTTP request. If you want to redirect a user, you will need to do this in Javascript on the client side.
Good article: http://web.archive.org/web/20090508005814/http://www.mikeduncan.com/named-anchors-are-not-sent/
Seeing as the server will never see the # (ruling out 301 Redirects) and Google has deprecated their AJAX Crawling scheme, it seems that a front-end solution is the only way!
How I did it:
(function() {
var redirects = [
['#!/about', '/about'],
['#!/contact', '/contact'],
['#!/page-x', '/pageX']
]
for (var i=0; i<redirects.length; i++) {
if (window.location.hash == redirects[i][0]) {
window.location.replace(redirects[i][1]);
}
}
})();
I'm assuming that because Google crawlers do indeed execute Javascript, the new pages will be indexed properly.
I've put it in a <script> tag directly underneath the <title> tag, so that it get executed before any other JS/CSS. Note that this script should only be required for your index file.
I am fairly certain that the hash/page anchor/bookmark part of a URL is not indexed by search engines, and therefore has no effect on your page ranking. Doing a google search for "inurl:#" returns zero documents, so that backs up my assumption. Links from external sites will be indexed without the hash.
You are right in that the hash part isn't sent to the server, so as far as I am aware, there isn't a good way to be able to create a redirection url with the hash in it.
Because of this, it's up to the browser to correctly manage the hash during a redirect. Firefox 3.5 appears to do this successfully. If you append a hash to a URL that has a known redirect, you will see the URL change in the address bar to the new location, but the hash stays on there successfully.
Edit: In response to the comment below, if there isn't a hash sign in the external URL for the part you need, then it is entirely possible to rewrite the URL. An Apache rewrite rule would take care of it:
RewriteCond %{HTTP_HOST} !^exemple\.oursite\.com [NC]
RewriteCond %{HTTP_HOST} !^$
RewriteRule ^/(.*) http://www.oursite.com/exemple/$1 [L,R]
If you're not using Apache, then you'll have to look into the server docs for something similar.
Google has a special syntax for AJAX applications that is based on hash URLs: http://code.google.com/web/ajaxcrawling/docs/getting-started.html
You could create a page on the old address that catches all requests and redirects to the new site with the correct address and code.
I did something like that, but it was in asp.net, which I guess it's not the language you use. Anyway there should be a way to do this in any language.
When returning status 301, your server is supposed to return a 'Location:' header which points to the new location. In practice, the way this is implemented varies; some servers provide the full URL (netloc and path), some just provide the new path and expect the browser to look for that path on the original netloc. It sounds like your rewrite rule is stripping the path.
An easy way to see what the returned Location header is, in the python shell:
>>> import httplib
>>> conn = httplib.HTTPConnection('exemple.oursite.com')
>>> conn.request('HEAD', '/')
>>> res = conn.getresponse()
>>> print res.getheader('location')
I'm afraid I don't know enough about mod_rewrite to tell you how to do the rewrite rule correctly, but this should give you an idea of what your server is actually telling clients to do.
The search bots don't care about hash tags. And if you are using them for some kind of flash or AJAX calls, you have more serious problems than your 301 redirects don't work. Because unless you have the content in an alternate form, the search engines are not indexing your site and you are definitely suffering as far as SEO goes.
I registered my account so I can't edit.
zombat : I'm sorry I made a mistake in my comment. The link to our video is exemple.oursite.com/#video_id=233. In this case, my rewrite rule in Apache doesn't work.
Nick Berardi: We changed the way our links work. We don't use # anymore, only for backward compatibility

Resources