by Bozho | Apr 27, 2013 | Aggregated, Developer tips, Opinions
Your system is probably sending some emails. Sometimes these emails contain links to the public part of the site, sometimes they have links to the authentication-protected part. Either way, if the email is sent to registered users (as opposed to just subscribed emails) you should not make the user type in username and password. Even if it’s the public part of the site, the user may then want to do something that requires authentication with the content you display – e.g. add it to favourites. It’s a bit tricky with public content though, and you might not want to have it there, as users tend to forward “digest” or “best this week” emails, and then the recipients will be able to impersonate them, without even knowing. Anyway, when users click on a link in an email sent by your system, they could be logged in automatically. That’s the product requirement I think many systems should have, and it sounds pretty reasonable. But I’ve rarely seen in. Let’s assume you like it and you want to implement it in your system. How to do that, as there are certainly some security implications? For each email sent, generate a token. The token should be the HMAC of (the user’s email (or username, or id) concatenated with the token generation timestamp) Use an application-wide, configurable per-environment key for the HMAC. Also use a good hash algorithm, like SHA-256 (and not MD5) Append the token to each link in the email. You are probably using an email template, so just have ?emailLoginToken=${token} for each link. Also pass the email and the timestamp as...
by Bozho | Apr 3, 2013 | Aggregated, Developer tips
For every project I’ve participated in, there has been a need for augmenting some third-party library. A couple of reasons: there’s a bug there’s missing functionality there’s functionality that doesn’t work as you need it to What do you do in these cases? Obviously, you report the problem or even suggest a fix. But until that goes into the next version, you need to get your work done. To do that, you have many options, depending on the severity of the situation and the quality of the library: extend the problematic class (or inject a custom implementation of some piece into it) – that’s the best way, as it is a purely object-oriented approach and doesn’t require any hacks. But it’s possible only if the problematic library is of good quality and is designed for extension get the sources, fix the problem, repackage the jar. That sounds like a nice approach, but it has some issues. If you use a dependency manager (and you should use one), it would need either installing the jar in a local repo, or using system scope + copy-dependencies plugin, or having a nexus installation and adding the jar there. The thing I dislike the most with this approach is that you don’t actually have the fix in your project – and you can’t quickly iterate when fixing it use reflection to access some hidden parts of the library extend a class, but copy-paste some methods that cannot be modified otherwise (because they are monolithic). I’ve done that many times, and although it’s a hacky approach, it is not that bad. Of course, try...
by Bozho | Mar 14, 2013 | Aggregated, Developer tips
Bitcoin is gaining popularity, and last week I decided to implement it as a payment option for my computer-generated music service. Why I decided to do that is detailed here (payment is only needed for commercial use of the music), but here I’ll share the technical details for implementing the bitcoin integration. First, you need to pick a payment gateway/provider. You can pick one from this list. They differ in terms of their API and specific flow, but the general flow should be almost the same. Some of the implementation details below are relevant only to what I picked up – Coinbase – but they should be similar for other providers. I picked Coinbase, because it seemed the most developer-friendly and straightforward. It has one bug that I had to workaround, but apart from that it’s ok. The general flow (probably containing some Coinbase specifics) is below. Note that I am describing the most complex scenario, where you have multiple items with variable prices and quantities. You can use the html/js code I used in my cart page. On the other hand, it’s assuming a best-case payment provider that does not redirect the user to external pages and uses simply a javascript dialog. Place a custom “Pay with Bitcoin” button on the checkout page Clicking it submits a form and thus triggers a back-end checkout process The back-end code saves a new purchase/order in the database and returns its id Then the back-end code invokes the payment gateway API, providing the order id (or any custom application data) and the price, and gets a code to identify the transaction...
by Bozho | Feb 23, 2013 | Aggregated, Developer tips, Opinions
There’s a trivial problem that every project has – keeping the database structure in sync with the application. That is, when your code relies on a new table or column, that table/column must appear in the database. This is especially a problem when there are multiple environments, on which the code gets deployed (production, stage, integration, local), as usually additional steps need to be performed in order to update the database schema. The quickest way to achieve the desired effect is to provide SQL upgrade scripts every time the code needs a new database element (or no longer needs one). But that’s tedious, as these sql scripts have to be executed manually on each environment the code gets deployed to. Automating this process has been achieved by a couple of frameworks, so that you don’t need to do it. Here is a list of options for the Java world. Why do we actually need such a solution? We aim for frequent, one-click deployments to staging and production environments. We can’t do that without an automated way of syncing the database (otherwise there will be missing columns, or obsolete non-null columns will prevent data insertion). And once in a while we may need to revert a release, and we’d have to rollback the database changes accordingly. While you can just drop and recreate the schema while developing locally, you can’t do that in production. Rails developers will rightly say “We’ve had that for a long time, out of the box”. Indeed, rails migrations seem like a perfect implementation of the idea of keeping the application code in sync with the...
by Bozho | Jan 22, 2013 | Aggregated, Developer tips
We’ve all done pagination – it’s sensible for both lists in the UI and for processing data in batches. “SELECT (columns) FROM table LIMIT X, Y”. Possibly “SELECT (columns) FROM table ORDER BY some_column LIMIT X, Y”. What’s the caveat? Especially when working with an ORM and when processing batches, where order doesn’t matter, you are likely to omit the ORDER BY clause. You would expect the results to be ordered by the primary key. And they are in most cases (though it is not guaranteed), but when you EXPLAIN the query, you can see that the index is not used for the query – a full table scan is performed to fetch the results, which is slow. Note that if we omit the LIMIT clause, again a full table scan is used, but this is something you’d rarely do – i.e. a query with no WHERE clause and no pagination. So, rule #1: always include an ORDER BY clause in order to use the index. For lists in the UI you’d usually order by some column – date modified, name, etc. That also performs a full table scan, unless you have an index on that column. So, rule #2: always have an index on the column you ORDER BY Kind of obvious things, but they may be silent performance issues lurking in your project. And now onto something not so obvious, that surprised me. When using LIMIT X, Y, MySQL scans the whole table (up until X+Y), regardless of the index. Note that even if the “type” (in the result of EXPLAIN) is not ALL (full table scan),...
Recent Comments