persisting header information with replace="instance"

Hello,

I recently ran into some trouble implementing cookies with Orbeon
Forms. I couldn't find any processors or anything like that for
dealing with cookies, so I moved on to the obvious choice of  using
the HTTP serializer. I've gotten it working, but it appears that none
of the response headers are sent back from /xforms-server-submit when
I'm submitting the instance using replace="instance" If I remove
@replace it works fine. All the headers and status code are returned
properly. (albeit from /xforms-server-submit)

Can anyone think of a way to get around this. I guess for most of the
other headers, I wouldn't really care, but I'm trying to remove my
cookie when a user logs out. (status codes would be nice to have
preserved though)

--
Daniel E. Renfer
http://kronkltd.net/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Daniel,

On 5/31/07, Daniel E. Renfer <[hidden email]> wrote:
> Can anyone think of a way to get around this. I guess for most of the
> other headers, I wouldn't really care, but I'm trying to remove my
> cookie when a user logs out. (status codes would be nice to have
> preserved though)

Would the session-invalidator do what you are looking for? See "5. Logout" on:

http://www.orbeon.com/ops/doc/reference-authentication

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
http://www.orbeon.com/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Alex,

Thank you for the tip, but I don't think oxf:session-invalidator will do the trick for me. Looking through this, it appears to be for using the servlet container to handle authentication using a username and password. This won't work for me, as I am rolling my own authentication using a custom OpenID processor.

I have the login and logout working properly, but I want to now set a cookie when the user logs in, and clear it when they explicitly log out. I'm using the http-serializer to return a 3xx status code with a Location header and a cookie on login, but am just doing a replace="instance" with a 2xx code and a cookie on logout.

The problem is, if I do a replace="instance" then all of the status codes and headers are lost. If I remove the replace="instance" logging out shows me my xml instance, but also clears my cookie. When I put it back, the cookie stays set and the status code is always 200.

Is this a bug in Orbeon Forms? Is there a way to work around this limitation, or contact the url directly?

--
Daniel E. Renfer
<a href="http://kronkltd.net/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> http://kronkltd.net/




--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Hi Daniel,

On 6/1/07, Daniel E. Renfer <[hidden email]> wrote:
> I have the login and logout working properly, but I want to now set a cookie
> when the user logs in, and clear it when they explicitly log out. I'm using
> the http-serializer to return a 3xx status code with a Location header and a
> cookie on login, but am just doing a replace="instance" with a 2xx code and
> a cookie on logout.

What is setting the cookie when the user logs in? What is the
replace="instance" used for?

> The problem is, if I do a replace="instance" then all of the status codes
> and headers are lost.

They are lost? Lost between what and what?

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
http://www.orbeon.com/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/4/07, Alessandro Vernet <[hidden email]> wrote: When a user does a POST on my authentication endpoint, the pipeline
performs all of the authentication steps and returns an XML instance
as well as a Set-Cookie header.

The replace="instance" is just so I can do this step without requiring
a refresh.

> > The problem is, if I do a replace="instance" then all of the status codes
> > and headers are lost.
>
> They are lost? Lost between what and what?
> Alex
> --
> Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
> http://www.orbeon.com/

The headers are lost between my authentication endpoint (what would be
returned if replace="all" were used) and what is actually returned by
/xforms-server-submit

Attached are the header info from two different logouts. The only
difference between the two is one is using replace="instance" and the
other has the replace attribute omitted. (replace="all") Pay attention
to the responses between the two. If you notice, the Set-Cookie header
is missing from instance.txt and the response code is 200 when I sent
202. (202 is most likely not the best code for this, but that's beside
the point)

Feel free to try it out if you want. You can get my web address from
the host information. (This site is very much unpolished and not ready
for public consumption yet.) You'll need a valid OpenID to log in, but
I added two log out buttons so you can try it both ways.

If you need any more information, let me know. I'm sure I could create
a reproducible test case for this, but I'd probably need to install a
fresh version of Orbeon Forms first as mine is somewhat modified.

--
Daniel E. Renfer
http://kronkltd.net/


--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Daniel,

On 6/5/07, Daniel E. Renfer <[hidden email]> wrote:
> The headers are lost between my authentication endpoint (what would be
> returned if replace="all" were used) and what is actually returned by
> /xforms-server-submit [...]

OK, I understand now. When you do a request with replace="instance",
first an Ajax request is made from the browser to Orbeon Forms. Then
Orbeon Forms makes a request to your service, which returns some XML
with a Set-Cookie header. Orbeon Forms replaces that instance on the
server-side, checks what impact that has on the UI, and tells the
browser in the Ajax response about those differences. But the headers
from the service are not forwarded to browser in the Ajax response,
and this explains why the header is not set on the browser when you do
a replace="instance".

Should we forward the Set-Cookie header? The browser makes a query to
Orbeon Forms on server A. But the replace="instance" can go to server
B. If A != B, then A can't sent back a cookie to the browser for B. If
A = B in your case? If it is (say of the path in the action attribute
of xforms:submission is relative), we can imagine forwarding the
Set-Cookie.

A workaround if you don't want to replace the page, you could have a
hidden frame and to a replace="all" to that frame using the
xxforms:target attribute. Do you think that would work for you?

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
http://www.orbeon.com/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/5/07, Alessandro Vernet <[hidden email]> wrote:


--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/5/07, Daniel E. Renfer <[hidden email]> wrote: I think it should work, but I never did this. So if you get a chance
to test this, please let us know how it works for you.

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
http://www.orbeon.com/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/5/07, Alessandro Vernet <[hidden email]> wrote: Not quite. When I try to send the response with a 3xx code and a
location header pointing to /openid/xml with replace="all" I get
exactly what I'm expecting, but when I try it with replace="instance"
nothing happens and my logs show this:

2007-06-05 11:23:09,171 TP-Processor2 INFO
httpclient.HttpMethodDirector null - Redirect requested but
followRedirects is disabled
2007-06-05 11:23:09,187 TP-Processor2 ERROR processor.XFormsServer
null - XForms - submission - xforms-submit-error throwable:
java.lang.ClassCastException: java.lang.String cannot be cast to
java.util.List
        at org.orbeon.oxf.xforms.XFormsModelSubmission.performDefaultAction(XFormsModelSubmission.java:780)
        at org.orbeon.oxf.xforms.XFormsContainingDocument.dispatchEvent(XFormsContainingDocument.java:918)
        at org.orbeon.oxf.xforms.action.actions.XFormsSendAction.execute(XFormsSendAction.java:45)
        at org.orbeon.oxf.xforms.action.XFormsActionInterpreter.runAction(XFormsActionInterpreter.java:116)
        at org.orbeon.oxf.xforms.action.actions.XFormsActionAction.execute(XFormsActionAction.java:32)
        at org.orbeon.oxf.xforms.action.XFormsActionInterpreter.runAction(XFormsActionInterpreter.java:116)
        at org.orbeon.oxf.xforms.XFormsContainingDocument.runAction(XFormsContainingDocument.java:970)
        at org.orbeon.oxf.xforms.event.XFormsEventHandlerImpl.handleEvent(XFormsEventHandlerImpl.java:85)
        at org.orbeon.oxf.xforms.XFormsContainingDocument.dispatchEvent(XFormsContainingDocument.java:899)
(snip)

I've been GREPing like crazy, but can't find where followRedirects is
being disabled at. (I assume that
java.net.HttpURLConnection.setFollowRedirects(false) is being called
somewhere)

In case in matters, I last integrated Forms on 2007/02/26 so if there
has any important updates to the submission processor I'll update. I'm
planning on updating anyway as soon I get a chance. (I didn't realize
till now that it's been so long)

--
Daniel E. Renfer
http://kronkltd.net/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/5/07, Daniel E. Renfer <[hidden email]> wrote:
> Not quite. When I try to send the response with a 3xx code and a
> location header pointing to /openid/xml with replace="all" I get
> exactly what I'm expecting, but when I try it with replace="instance"
> nothing happens and my logs show this: [...]

What do you expect to happen when you do a replace="instance" and the
response has a 3xx code? What are you redirecting to? Is it an XML
document that can be used to replace the instance?

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
http://www.orbeon.com/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/6/07, Alessandro Vernet <[hidden email]> wrote: Basically what I expected was that it would follow the redirects (a
sane number of times) and use the final page as the resource to
replace the instance with. I was redirecting to another XML document.
(it had the same information as I was previously returning)

--
Daniel E. Renfer
http://kronkltd.net/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/6/07, Daniel E. Renfer <[hidden email]> wrote:
> Basically what I expected was that it would follow the redirects (a
> sane number of times) and use the final page as the resource to
> replace the instance with. I was redirecting to another XML document.
> (it had the same information as I was previously returning)

And you are saying that it does not follow the redirect and that you
are getting the error "Redirect requested but followRedirects is
disabled"?

I think there is no downside in always following redirects when doing
a request to a service. If this is the problem, then I think we should
be able to implement this.

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
http://www.orbeon.com/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

On 6/7/07, Alessandro Vernet <[hidden email]> wrote: Correct. That is what I'm seeing when I return a redirect page when
using replace="instance".

Although, I've been thinking about it, and I don't think the way this
would undoubtedly be implemented would do the trick for me. I'm
assuming that the way you would do this is to follow the redirects
behind the scenes and return from /xforms-server-submit as if that
final URI had been requested directly. This wouldn't help me because
unless I see that 3xx page, my cookies wouldn't be set.

So, while supporting redirects on submission is still a good thing,
it's looking like unless there is a radical redesign of the submission
processor (which I'm sure is not on the table right now) it's looking
like I'm either going to have to try that replace into a frame +
trigger loading new instance data trick, or simply requiring a page
refresh when I need to set a cookie.

I'm not too terribly versed on the operation of the submission
processor, but it seems like the reason that submissions are done the
way they are is so the page doesn't have to hit the server, get the
instance to be submitted, perform the submission, get the response,
send that response to the server, and retrieve information about the
updated UI. (depending on the size of the instance, a very wasteful
operation) Am I right about this? (or at least close.)

While performing the submissions directly wouldn't work for the
majority of cases, what about an extension attribute on xf:submit that
tells it to do something similar to this. (@xxforms:direct="true")
Just a thought.

--
Daniel E. Renfer
http://kronkltd.net/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws

Hi Daniel,

On 6/7/07, Daniel E. Renfer <[hidden email]> wrote:
> Although, I've been thinking about it, and I don't think the way this
> would undoubtedly be implemented would do the trick for me. I'm
> assuming that the way you would do this is to follow the redirects
> behind the scenes and return from /xforms-server-submit as if that
> final URI had been requested directly. This wouldn't help me because
> unless I see that 3xx page, my cookies wouldn't be set.

That is right. It would follow the redirect on the server-side, but
the browser would not see the Set-Cookie sent by the response that
caused the redirect. Exactly like you said.

> So, while supporting redirects on submission is still a good thing,
> it's looking like unless there is a radical redesign of the submission
> processor (which I'm sure is not on the table right now) it's looking
> like I'm either going to have to try that replace into a frame +
> trigger loading new instance data trick, or simply requiring a page
> refresh when I need to set a cookie.

Maybe you could use an <xforms:load resource="..."/> action. With
xforms:load, the resource will be loaded directly by the browser. Here
"resource" would point to the "page" that responds with a redirect and
sets cookies. Would that be possible in your case?

> While performing the submissions directly wouldn't work for the
> majority of cases, what about an extension attribute on xf:submit that
> tells it to do something similar to this. (@xxforms:direct="true")
> Just a thought.

The problem is that in the case where XML is posted to the server,
first the browser doesn't have the XML that would need to be posted,
and more importantly the browser doesn't have the ability to post XML
and get back an HTML page. You can only post XML in an Ajax request
from the browser. There is a subset of the submissions that we could
handle this way (e.g. if you have a method="get" and you don't care
about catching xforms-submit-error), and we had some thought about
automatically detecting those cases and then doing a "direct"
submission. But since in most of those cases you can instead do a
<xforms:load>, there isn't a strong motivation to implement this.

Alex
--
Orbeon Forms - Web 2.0 Forms, open-source, for the Enterprise
http://www.orbeon.com/



--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
ObjectWeb mailing lists service home page: http://www.objectweb.org/wws