Zend Amf now with php session support
PHP session support is now enabled through the Zend Amf. To get started you need to update your Zend_Amf_Server class from the repository. You will also need to make sure you have Zend_Session for those of you that are using the framework on as use-at-will bases.
Once you have updated your server you will need to also update your bootstrap/endpoint file to start using sessions and tell Zend Amf to use sessions.
$server = new Zend_Amf_Server();
Zend_Session::start();
$server->setSession();
You now have session support for all of your services.
A session example
We are going to create the following example in order to showcase how sessions can be used in an application.
Flex zend amf php session example
The flex application connects to this SessionTest a service that opens a session count variable that is incremented with the getCount method. There are also three utility methods to show how sessions are being handled. The method getSessionID returns the current php session id. The method updateSessionID tells php to regenerate the sessions id. Finally unregister destroys the count session variable to start the incrimination over on the next service call.
/**
* Example class for sending a session back to ActionScript.
*/
class SessionTest
{
/** Check if the session is available or create it. */
public function __construct() {
if (!isset($_SESSION['count'])) {
$_SESSION['count'] = 0;
}
}
/** increment the current count session variable and return it's value */
public function getCount()
{
$_SESSION['count']++;
return $_SESSION['count'];
}
/** return the php session id value */
public function getSessionID()
{
return session_id();
}
/** Tell's php to generate a new session id */
public function updateSessionID()
{
session_regenerate_id();
}
/** clear the refrence to the count session variable */
public function unregister() {
unset($_SESSION['count']);
return true;
}
}
The flex code just consists of calls to the remote methods. There is nothing that you need to do special in your ActionScript in order to handle sessions. Note that there are just methods and handlers for all of the service calls.
Sessions are used for state but Flex is state-full?
Using sessions is important for storing state on the server. This can be hard to wrap your head around when to store state in the client and sync that state with the server. My recommendation is that you should use sessions when you don’t trust the client or that the data is so important that you shouldn’t ever trust the client. Using sessions with Zend_ACL and Zend_Auth are great examples of when you want to keep state in client and validate that state in the server. If something changes that was not intentional invalidate the state and log the customer out.
Session Identifiers
This is import to do as frequently as you can in you application. A new session ID can decrease the ability for a cross site scripting attack to take over your session and become a logged in user. In this example I have used a php call but make sure that you check out the documentation on Zend Session and specifically Zend_Session::regenerateId()
A primary difference between an RIA written in Flex, ajax, etc is that it does not reload the browser. This means that the user can aggressively click on a button and the RIA does not have the new session id returned. You can start “loosing” data as the new call is being sent with an old session id. If you application has aggressive click make sure you test regeneration speeds with slow connections. A proxy tools such as charles can really help debug slow connections.
At a minimal regenerate an id on massive state changes of the application! Login, logout, privilege escalation, etc.
Click around on the demo below to see what I mean!
Finally
Give me your feedback. Sessions will be in the next minor so there is still time to change things, document better, and make more examples. Have fun!
Recent Comments