HTTP & Middleware - akrabat.com€¦ · Slim. Created by Josh Lockhart (phptherightway.com) •...

Preview:

Click to see full reader

Citation preview

HTTP & MiddlewareRob Allen

   

November 2018

Slim: The C in MVC

Rob Allen ~ @akrabat

Microframework?
Clear and concise codebase
Maps routes to actions
The C in MVC
You pick everything else!
Works best now that we have Composer

SlimCreated by Josh Lockhart (phptherightway.com)• PSR-2 coding style• PSR-4 autoloading• PSR-7 Request and Response objects• PSR-11 container support• Middleware architecture (PSR-15 upcoming)

Rob Allen ~ @akrabat

HTTP messages

Rob Allen ~ @akrabat

HTTP messages

Rob Allen ~ @akrabat

RequestGET / HTTP/1.1Host: akrabat.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:63.0) Gecko/20100101 Firefox/63.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveIf-Modified-Since: Mon, 04 Nov 2018 16:21:02 GMTCache-Control: max-age=0

Rob Allen ~ @akrabat

ResponseHTTP/1.1 200 OKServer: nginx/1.7.6Date: Mon, 04 Nov 2018 16:27:06 GMTContent-Type: text/html; charset=UTF-8Content-Length: 16091Connection: keep-aliveKeep-Alive: timeout=65Vary: Accept-Encoding, CookieCache-Control: max-age=3, must-revalidateContent-Encoding: gzipLast-Modified: Mon, 04 Apr 2016 16:21:02 GMTStrict-Transport-Security: max-age=15768000

<!DOCTYPE html><head>

Rob Allen ~ @akrabat

How do we do this in PHP?Request:• $_SERVER, $_GET, $_POST, $_COOKIE, $_FILES• apache_request_headers() / getallheaders()• php://input

Rob Allen ~ @akrabat

How do we do this in PHP?Response:• header()• http_response_code()• header_list() / headers_sent()• echo (& ob_*() family)

Rob Allen ~ @akrabat

Special cases for header():
1. start with 'http/' to set status code
2. 'location' will auto-set the code to 302 for you

How do we do this in PHP?URI:scheme://username:password@hostname:port/path?arg=value#anchor

• parse_url()• parse_str()• http_build_query()

Rob Allen ~ @akrabat

There's always string concatenation too!

PSR 7: HTTP messaging• Provides for a uniform access to HTTP messages• A set of interfaces for requests and responses• Created by Framework Interoperability Group

Rob Allen ~ @akrabat

It's just a set of interfaces

Rob Allen ~ @akrabat

Models RFC 7230 & RFC 7231
UriInteface models RFC 3986

RequestInterface• Protocol version• HTTP method• URI• Headers• Body

Rob Allen ~ @akrabat

ServerRequestInterfaceIn addition to RequestInterface:• Server parameters• Query string arguments• Deserialised body• Uploaded Files• Attributes

Rob Allen ~ @akrabat

Response• Protocol version• Status code (& reason phrase)• Headers• Body

Rob Allen ~ @akrabat

Two key things aboutPSR-7

Rob Allen ~ @akrabat

Firstly: Messages and URIsare IMMUTABLE!

Rob Allen ~ @akrabat

ImmutabilityRequest, ServerRequest, Response & Uri are immutable$uri = new Uri('https://api.joind.in/v2.1/events');$uri2 = $uri->withQuery('?filter=upcoming');$uri3 = $uri->withQuery('?filter=cfp');

Rob Allen ~ @akrabat

ImmutabilityRequest, ServerRequest, Response & Uri are immutable$uri = new Uri('https://api.joind.in/v2.1/events');$uri2 = $uri->withQuery('?filter=upcoming');$uri3 = $uri->withQuery('?filter=cfp');

public function withQuery($query){ $clone = clone $this; $clone->query = $this->filterQuery($query); return $clone;}

Rob Allen ~ @akrabat

Common mistake$response = new Response();$response->withStatus(302);$response->withHeader('Location', 'http://example.com');

return $response;

Rob Allen ~ @akrabat

What you meant!$response = new Response();$response = $response->withStatus(302);$response = $response->withHeader('Location', 'http://example.com');

// or

$response = new Response();$response = $response->withStatus(302) ->withHeader('Location', 'http://example.com');

Rob Allen ~ @akrabat

HeadersReading from the message:$request->hasHeader('Accept'); // boolean$request->getHeader('Accept'); // array$request->getHeaderLine('Accept'); // string

Updating the message:$response = $response->withHeader('Accept', 'application/xml');$response = $response->withAddedHeader('Accept', 'text/xml');$response = $response->withoutHeader('Location');

Rob Allen ~ @akrabat

Secondly: Message bodiesare STREAMS

Rob Allen ~ @akrabat

StreamsAllows for very large message bodies in a memory efficientmanner$largeFile = __DIR__ . '/brand_guidelines.ppt';

return (new Response()) ->withHeader('Content-Type', 'application/vnd.ms-powerpoint') ->withHeader('Content-Length', (string) filesize($largeFile)) ->withBody(new Stream($largeFile));

Rob Allen ~ @akrabat

Handling stringsFor strings, use the php:://temp stream: $response = $response->withBody(new Stream('php://temp')); $response->getBody()->write('Hello world!');

Rob Allen ~ @akrabat

Mutable!$body->write('Hello');$body->write(' World!');

$response = (new Response()) ->withStatus(200, 'OK') ->withHeader('Content-Type', 'application/html') ->withBody($body);

 Mitigate:

Use read-only streams for server requests and client responses

Rob Allen ~ @akrabat

ServerRequest AttributesAllow passing of data from one component to the next// component 1function findCountry($request) { $country = $this->geoLocate($request); $request = $request->withAttribute('country', $country); return $request;}

// In an action methodfunction listAction($request, $response, $args) { $country = $request->getAttribute('country'); // do something now that we know the country}

Rob Allen ~ @akrabat

MiddlewareTurns a request in to a response

Rob Allen ~ @akrabat

Middleware

Rob Allen ~ @akrabat

This is not new• NodeJS: Connect• Python: WSGI• Ruby: Rack• PHP: StackPHP, Slim

Rob Allen ~ @akrabat

Prior to PSR-7, the PHP ones were not compatible with each other!

PSR-7 Signature (by convention) function ( ServerRequestInterface $request, ResponseInterface $response, callable $next ) : ResponseInterface;

Rob Allen ~ @akrabat

PSR-7 Signature (by convention) function ( ServerRequestInterface $request, ResponseInterface $response, callable $next ) : ResponseInterface;

Rob Allen ~ @akrabat

PSR-7 Signature (by convention) function ( ServerRequestInterface $request, ResponseInterface $response, callable $next ) : ResponseInterface;

Rob Allen ~ @akrabat

PSR-7 Signature (by convention) function ( ServerRequestInterface $request, ResponseInterface $response, callable $next ) : ResponseInterface;

Rob Allen ~ @akrabat

PSR-7 Signature (by convention) function ( ServerRequestInterface $request, ResponseInterface $response, callable $next ) : ResponseInterface;

Rob Allen ~ @akrabat

PSR-7 Middlewarefunction (ServerRequestInterface $request, ResponseInterface $response, callable $next) : ResponseInterface{ // do something before

// call down the chain to the next middleware if ($next) { $response = $next($request, $response); }

// do something with $response after

return $response;}

Rob Allen ~ @akrabat

PSR-7 Middlewarefunction (ServerRequestInterface $request, ResponseInterface $response, callable $next) : ResponseInterface{ // do something before

// call down the chain to the next middleware if ($next) { $response = $next($request, $response); }

// do something with $response after

return $response;}

Rob Allen ~ @akrabat

PSR-7 Middlewarefunction (ServerRequestInterface $request, ResponseInterface $response, callable $next) : ResponseInterface{ // do something before

// call down the chain to the next middleware if ($next) { $response = $next($request, $response); }

// do something with $response after

return $response;}

Rob Allen ~ @akrabat

PSR-7 Middlewarefunction (ServerRequestInterface $request, ResponseInterface $response, callable $next) : ResponseInterface{ // do something before

// call down the chain to the next middleware if ($next) { $response = $next($request, $response); }

// do something with $response after

return $response;}

Rob Allen ~ @akrabat

PSR-7 Middlewarefunction (ServerRequestInterface $request, ResponseInterface $response, callable $next) : ResponseInterface{ // do something before

// call down the chain to the next middleware if ($next) { $response = $next($request, $response); }

// do something with $response after

return $response;}

Rob Allen ~ @akrabat

What can you do with Middleware?Session CORS CSRFLogging Firewall Debug barAuthentication Throttling Error handlingHTTP cache Honeypot ValidationCSP etc...

Rob Allen ~ @akrabat

Middleware dispatching$app = new Slim\App();

$app->add($mw1);$app->add(SomeMiddleware::class);$app->add('MoreMiddleware');$app->add([$instance, 'methodName']);$app->add(function ($request, $response, $next) { return $next($request, $response);});

$response = $app->run();

Rob Allen ~ @akrabat

Data transfer between middlewareAttributes allow passing of data from one middleware to the nextclass IpAddress{ public function __invoke($request, $response, $next) { $ipAddress = $this->determineClientIpAddress($request); $request = $request->withAttribute('ip_address', $ipAddress); return $response = $next($request, $response); }

// full source: github.com/akrabat/ip-address-middleware}

Rob Allen ~ @akrabat

see: https://github.com/akrabat/ip-address-middleware

Data transfer between middlewareAttributes allow passing of data from one middleware to the nextclass IpAddressMiddleware{ public function __invoke($request, $response, $next) { $ipAddress = $this->determineClientIpAddress($request); $request = $request->withAttribute('ip_address', $ipAddress); return $response = $next($request, $response); }

// full source: github.com/akrabat/ip-address-middleware}

Rob Allen ~ @akrabat

Data transfer between middlewareAttributes allow passing of data from one middleware to the nextclass IpAddressMiddleware{ public function __invoke($request, $response, $next) { $ipAddress = $this->determineClientIpAddress($request); $request = $request->withAttribute('ip_address', $ipAddress); return $response = $next($request, $response); }

// full source: github.com/akrabat/ip-address-middleware}

Rob Allen ~ @akrabat

Data transfer between middlewareAttributes allow passing of data from one middleware to the nextclass IpAddressMiddleware{ public function __invoke($request, $response, $next) { $ipAddress = $this->determineClientIpAddress($request); $request = $request->withAttribute('ip_address', $ipAddress); return $response = $next($request, $response); }

// full source: github.com/akrabat/ip-address-middleware}

Rob Allen ~ @akrabat

Data transfer between middlewareAttributes allow passing of data from one middleware to the nextclass IpAddressMiddleware{ public function __invoke($request, $response, $next) { $ipAddress = $this->determineClientIpAddress($request); $request = $request->withAttribute('ip_address', $ipAddress); return $response = $next($request, $response); }

// full source: github.com/akrabat/ip-address-middleware}

Rob Allen ~ @akrabat

Data transfer between middlewareRead the attributeclass GuardMiddleware{ protected $allowedIps = [10.0.0.1, 192.168.0.1]

public function __invoke($request, $response, $next) { $ipAddress = $request->getAttribute('ip_address'); if (!in_array($ipAddress, $this->allowedIps)) { return $response->withStatus(401); } return $next($request, $response); }}

Rob Allen ~ @akrabat

Data transfer between middlewareRead the attributeclass GuardMiddleware{ protected $allowedIps = [10.0.0.1, 192.168.0.1]

public function __invoke($request, $response, $next) { $ipAddress = $request->getAttribute('ip_address'); if (!in_array($ipAddress, $this->allowedIps)) { return $response->withStatus(401); } return $next($request, $response); }}

Rob Allen ~ @akrabat

Data transfer between middlewareRead the attributeclass GuardMiddleware{ protected $allowedIps = [10.0.0.1, 192.168.0.1]

public function __invoke($request, $response, $next) { $ipAddress = $request->getAttribute('ip_address'); if (!in_array($ipAddress, $this->allowedIps)) { return $response->withStatus(401); } return $next($request, $response); }}

Rob Allen ~ @akrabat

Data transfer between middlewareRead the attributeclass GuardMiddleware{ protected $allowedIps = [10.0.0.1, 192.168.0.1]

public function __invoke($request, $response, $next) { $ipAddress = $request->getAttribute('ip_address'); if (!in_array($ipAddress, $this->allowedIps)) { return $response->withStatus(401); } return $next($request, $response); }}

Rob Allen ~ @akrabat

Data transfer between middlewareRead the attributeclass GuardMiddleware{ protected $allowedIps = [10.0.0.1, 192.168.0.1]

public function __invoke($request, $response, $next) { $ipAddress = $request->getAttribute('ip_address'); if (!in_array($ipAddress, $this->allowedIps)) { return $response->withStatus(401); } return $next($request, $response); }}

Rob Allen ~ @akrabat

PSR-15Two Interfaces from the Framework Interoperability Group:

• Psr\Http\Server\MiddlewareInterface• Psr\Http\Server\RequestHandlerInterface

Rob Allen ~ @akrabat

PSR-15 MiddlewareInterfacenamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface MiddlewareInterface{ public function process( ServerRequestInterface $request, RequestHandlerInterface $handler ) : ResponseInterface;}

Rob Allen ~ @akrabat

PSR-15 MiddlewareInterfacenamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface MiddlewareInterface{ public function process( ServerRequestInterface $request, RequestHandlerInterface $handler ) : ResponseInterface;}

Rob Allen ~ @akrabat

PSR-15 MiddlewareInterfacenamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface MiddlewareInterface{ public function process( ServerRequestInterface $request, RequestHandlerInterface $handler ) : ResponseInterface;}

Rob Allen ~ @akrabat

PSR-15 MiddlewareInterfacenamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface MiddlewareInterface{ public function process( ServerRequestInterface $request, RequestHandlerInterface $handler ) : ResponseInterface;}

Rob Allen ~ @akrabat

PSR-15 MiddlewareInterfacenamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface MiddlewareInterface{ public function process( ServerRequestInterface $request, RequestHandlerInterface $handler ) : ResponseInterface;}

Rob Allen ~ @akrabat

Structure of PSR-15 middlewareclass TimerMiddleware implements MiddlewareInterface{ public function process($request, $handler) { $start = microtime(true);

$response = $handler->handle($request);

$taken = microtime(true) - $start; $response->getBody()->write("<!-- Time: $taken -->");

return $response; }}

Rob Allen ~ @akrabat

Structure of PSR-15 middlewareclass TimerMiddleware implements MiddlewareInterface{ public function process($request, $handler) { $start = microtime(true);

$response = $handler->handle($request);

$taken = microtime(true) - $start; $response->getBody()->write("<!-- Time: $taken -->");

return $response; }}

Rob Allen ~ @akrabat

Structure of PSR-15 middlewareclass TimerMiddleware implements MiddlewareInterface{ public function process($request, $handler) { $start = microtime(true);

$response = $handler->handle($request);

$taken = microtime(true) - $start; $response->getBody()->write("<!-- Time: $taken -->");

return $response; }}

Rob Allen ~ @akrabat

Structure of PSR-15 middlewareclass TimerMiddleware implements MiddlewareInterface{ public function process($request, $handler) { $start = microtime(true);

$response = $handler->handle($request);

$taken = microtime(true) - $start; $response->getBody()->write("<!-- Time: $taken -->");

return $response; }}

Rob Allen ~ @akrabat

Structure of PSR-15 middlewareclass TimerMiddleware implements MiddlewareInterface{ public function process($request, $handler) { $start = microtime(true);

$response = $handler->handle($request);

$taken = microtime(true) - $start; $response->getBody()->write("<!-- Time: $taken -->");

return $response; }}

Rob Allen ~ @akrabat

Structure of PSR-15 middlewareclass TimerMiddleware implements MiddlewareInterface{ public function process($request, $handler) { $start = microtime(true);

$response = $handler->handle($request);

$taken = microtime(true) - $start; $response->getBody()->write("<!-- Time: $taken -->");

return $response; }}

Rob Allen ~ @akrabat

PSR-15 RequestHandlernamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface RequestHandlerInterface{ public function handle( ServerRequestInterface $request ): ResponseInterface;}

Rob Allen ~ @akrabat

The of the the line!

PSR-15 RequestHandlernamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface RequestHandlerInterface{ public function handle( ServerRequestInterface $request ): ResponseInterface;}

Rob Allen ~ @akrabat

PSR-15 RequestHandlernamespace Psr\Http\Server;

use Psr\Http\Message\ResponseInterface;use Psr\Http\Message\ServerRequestInterface;

interface RequestHandlerInterface{ public function handle( ServerRequestInterface $request ): ResponseInterface;}

Rob Allen ~ @akrabat

A typical PSR-15 RequestHandlernamespace App\Handler;

// (use statements here)

class HomePageHandler implements RequestHandlerInterface{ public function handle(ServerRequestInterface $request) : ResponseInterface { return new HtmlResponse( '<p>Hello World</p>' ); }}

Rob Allen ~ @akrabat

AKA: Controller action

A typical PSR-15 RequestHandlernamespace App\Handler;

// (use statements here)

class HomePageHandler implements RequestHandlerInterface{ public function handle(ServerRequestInterface $request) : ResponseInterface { return new HtmlResponse( '<p>Hello World</p>' ); }}

Rob Allen ~ @akrabat

As we implement an interface, you don't get to choose the
name of the action method like you would do in say Laravel
As a result, we name our class well

A typical PSR-15 RequestHandlernamespace App\Handler;

// (use statements here)

class HomePageHandler implements RequestHandlerInterface{ public function handle(ServerRequestInterface $request) : ResponseInterface { return new HtmlResponse( '<p>Hello World</p>' ); }}

Rob Allen ~ @akrabat

You must create your own response

Frameworks

Rob Allen ~ @akrabat

Zend Expressive: PSR-15$app = new Zend\Expressive\Application(/* ... */);

// add middleware$app->pipe(ErrorHandler::class);$app->pipe(RouteMiddleware::class);$app->pipe(IpAddress::class);$app->pipe(DispatchMiddleware::class);

// add routes$app->get('/', App\Handler\HomePageHandler::class);$app->get('/api/ping', App\Handler\PingHandler::class);

// run$app->run();

Rob Allen ~ @akrabat

Slim Framework: PSR-7$app = new Slim\App();

// add middleware$app->add(IpAddress::class);

// add routes$app->get('/', App\Action\HomePageAction::class);$app->get('/api/ping', 'App\Controller\ApiController:pingAction');

// run$app->run();

Rob Allen ~ @akrabat

Middleware componentsSearch on Packagist• https://packagist.org/search/?q=psr-7%20middleware• https://packagist.org/search/?query=psr-15%20middleware

Ones I use:• akrabat: ip-address-middleware & proxy-detection-middleware• tuupola: cors-middleware, slim-jwt-auth & slim-basic-auth• franzl: whoops-middleware• oscarotero: psr7-middlewares & psr15-middlewares

Rob Allen ~ @akrabat

https://packagist.org/search/?q=psr-7%20middleware
https://packagist.org/search/?query=psr-15%20middleware

Resources• https://www.php-fig.org/psr/psr-7• https://www.php-fig.org/psr/psr-15• https://www.php-fig.org/psr/psr-17

• https://mwop.net/blog/2015-01-26-psr-7-by-example.html• https://mwop.net/blog/2018-01-23-psr-15.html

Rob Allen ~ @akrabat

https://www.php-fig.org/psr/psr-7
https://www.php-fig.org/psr/psr-15
https://www.php-fig.org/psr/psr-17
https://mwop.net/blog/2015-01-26-psr-7-by-example.html
https://mwop.net/blog/2018-01-23-psr-15.html

Thank you!Rob Allen

   

http://akrabat.com - @akrabat

http://akrabat.com

Recommended

Winchester Super X 3 Autoloading Shotgun Owner’s … ·  · 2010-03-06Important instructions for Winchester® Super X® 3 Autoloading Shotgun Winchester Rifles and Shotguns Customer
Documents
PSR Umbria
Economy & Finance
Double Action Autoloading Pistols
Documents
PSR-4000BN DI Series...2020/09/22  · PSR-4000BN DI Series includes PSR-4000BN DI, PSR-4000BN (HV) DI, and PSR-4000BN (DG) DI. They are twocomponent, alkaline developable LPI solder
Documents
Autoloading Pistols for Police Officers (NIJ … · This document, NIJ Standard-0112.03, Autoloading Pistols for Police Officers, is an equipment standard devel-oped by the Office
Documents
psr internet.pdf
Documents
PSR Sicilia
Documents
AUTOLOADING HUNTING RIFLE version ”VEPR-HUNTER…molot.biz/public/files/passports/en-vpo-102.pdf · Autoloading hunting rifle version "VEPR-HUNTER" in.30-06 Spr. caliber for hunting
Documents
WINCHESTER SX-AR™ AUTOLOADING RIFLE OWNER’S MANUAL
Documents
YQLW Qt UR]P U velikosti.pdfpsr 73/74/79/1 25 psr 140/160/1 75 psr 21 5/225 psr 260/270/280/290 psr 295/340/350 psr 540/550/730/740 psr 1000/2000 psr 1500/3000/8000 psr 9000 psr a300
Documents
psr básico.pdf
Documents
Psr solutions
Recruiting & HR
AUTOLOADING HUNTING RIFLE version ”VEPR-308” …molot.biz/public/files/passports/en-sok-95.pdf · 7 4 STANDARD EQUIPMENT No. Description Qn-ty * Remarks 1 Autoloading hunting
Documents
Current Status of Japanese projects - icrr.u-tokyo.ac.jp · • PSR B1913+16 • PSR B1534+12 • PSR J1141-6545 • PSR J0737-3039 • PSR J1906+0746 Existing neutron star binaries
Documents
PSR MAGAZINE
Documents
Pufferspeicher mit 1 Register – PSR · Pufferspeicher mit 1 Register – PSR PSR 300 PSR 500 PSR 800 PSR 1000 PSR 1500 PSR 2000 PSR 2500 Fassungsvermögen l 300 500 800 1000 1500
Documents
9mm/45 Caliber Autoloading Pistols - NCJRS · NIJ Standard"()112.01 9 mm/45 CALIBER AUTOLOADING PISTOLS 1. PURPOSE AND SCOPE Tbis standard establisbes performance requirements and
Documents
PSR: standardising HTTP - Kurakin€¦ · • PSR-7: HTTP Message Interfaces •PSR-15: HTTP Handlers •We have 3 PSRs PSR-17: HTTP Factories. PSR-7. Accepted on 19th of May, 2015
Documents
PSR PROFILE
Documents
Building an API with Apigility - akrabat.com
Documents