Server-side Scripting Martin Kruliš by Martin Kruliš (v1.2) 14.11.2016

Web Server (Revision) Serving Static Pages ` Web Server Internet Apache configuration /var/www/myweb/ ` HTTP Request GET /myweb/index.html ... Web Server Internet Client index.html HTTP Response HTTP/1.1 200 OK Content-Length: 1019 Content-Type: text/html; ... <contents of index.html> by Martin Kruliš (v1.2) 14.11.2016

Web Server (Revision) Serving Dynamic Content ` Web Server Internet /var/www/myweb/ ` HTTP Request GET /myweb/app.cgi ... Web Server Internet app.cgi Client stdin stdout Please note the security issues of such solution. If the web server is public, anyone in the world can make your server start a process. Furthermore, your CGI application has to be very secure, especially when dealing with inputs. HTTP Response HTTP/1.1 200 OK Content-Length: 2049 Content-Type: text/html; ... <contents generated by cgi> by Martin Kruliš (v1.2) 14.11.2016

CGI Common Gateway Interface One of the first standards for generating dynamic web content NSCA specification from 1993 how to invoke command line applications Current version CGI 1.1 (RFC 3875) from 2004 Specifies only the interface Application may be written in any language Important information and headers are set as environ- ment variables, POST body is directed to std. input Response is taken from the std. output Note that the server must be configured to recognize, when to execute CGI application and when to simply send back a requested file. E.g., apache can be configured <Directory /home/*/public_html/cgi-bin> Options ExecCGI SetHandler cgi-script </Directory> Will set the server to treat all files in each cgi-bin of each Example 1 by Martin Kruliš (v1.2) 14.11.2016

FastCGI CGI Issues Fast CGI Improvement Starting a process takes some system time Each process handles exactly one request Unable to keep session/shared data in memory Fast CGI Improvement Fast CGI server runs independently from web server Keeps the process pool, resources, … Communicates with web server via socket/TCP Multi-request processing may be achieved by multiplexing or multiple connections (or both) by Martin Kruliš (v1.2) 14.11.2016

Web Server (Revision) Integrating Scripting Modules ` Web Server /var/www/myweb/ ` HTTP Request GET /myweb/index.php ... Web Server index.php Internet mod_php Client HTTP Response HTTP/1.1 200 OK Content-Length: 1984 Content-Type: text/html; ... <contents generated by php> by Martin Kruliš (v1.2) 14.11.2016

PHP PHP: Hypertext Preprocessor Popular language originally designed for the web The language has integrate API for handling requests Things like URL parameters, POSTed data, headers, or server settings are presented in global variables PHP script code can be directly interleaved with HTML (or other type of generated content) The script is embedded between <?php, ?> marks The PHP interpret process the script and replace its body with its output in the document Example 2 by Martin Kruliš (v1.2) 14.11.2016

WSGI Web Server Gateway Interface Universal interface between web servers and web applications designed for the Python language Interface is called WSGI middleware and it is implemented by both sides (server and application) Specific new features Routing requests to application objects (by URL) Multiple applications may run in one process Content post-processing (e.g., by XSLT) Load balancing (remote processing, forwarding, …) Similar APIs Rack (Ruby), PSGI (Perl), JSGI (JavaScript) Example 3 by Martin Kruliš (v1.2) 14.11.2016

ASP.NET ASP.NET Microsoft solution built on .NET platform Supports all .NET languages (C#, VB, …) Successor to Microsoft’s Active Server Pages Requires Microsoft IIS web server Mono version (mod_mono and FastCGI) exists WebForms Basic building blocks for ASP.NET web pages Similar HTML interleaving syntax as PHP The idea is to design web pages in the same manner as desktop applications by Martin Kruliš (v1.2) 14.11.2016

ASP.NET ASP.NET WebForms Razor syntax MVC Event-based model, events may be processed at server The forms automatically serializes the whole state Razor syntax Block starts with @ and does not require explicit closing MVC Alternative type of ASP.NET applications Default view engine is either Razor (.cshtml, .vbhtml), or Web Forms (.aspx) Controllers are .NET classes, methods are actions Routers select controller class and invoke an action by Martin Kruliš (v1.2) 14.11.2016

JSP Java Server Pages Java-based solution for dynamic web pages Requires web server with servlet container Apache Tomcat, Jetty, … Supports both “simple” PHP-like approach and MVC Uses <%, %> marks for scriptlet-HTML interleaving MVC usually uses JavaBeans as the model and Java servlets as the controller Java compilation Compiler is integrated in the web server and compiles the page when first needed (or when changed) There are also other efforts to employ Java for web pages. For instance the Google Web Toolkit (http://www.gwtproject.org/) is a framework that allows you to design the whole web application as a Java application. It compiles the client-side parts of the code into JavaScript and automatically handlers the client-server communication. by Martin Kruliš (v1.2) 14.11.2016

Other Java Alternatives JSP is (almost) dead… Many alternatives Spring MVC Spring boot JSF Vaadin Play 1, Play 2 Struts 1, Struts 2 GWT Grails Wicket … http://zeroturnaround.com/rebellabs/java-tools-and-technologies-landscape-2016/ http://zeroturnaround.com/rebellabs/the-curious-coders-java-web-frameworks-comparison-spring-mvc-grails-vaadin-gwt-wicket-play-struts-and-jsf/ by Martin Kruliš (v1.2) 14.11.2016

Ruby on Rails Ruby on Rails Ruby scripting language + Rails web framework Basic philosophy DRY (Don’t Repeat Yourself) – avoid code duplication Convention Over Configuration – our way is the “best” Very strict style of application development Improves efficiency, but ties your hands Specific structure of the application Reflects the MVC pattern $> rails new myapp Generates new application structure in ./myapp To install Ruby on Rails on Linux, I recommend using Ruby Version Manager (https://rvm.io/). The rails framework is then installed privately in local homes. Installing rails globally (using sudo and/or deb packages) did not meet with success (at least not in my case). by Martin Kruliš (v1.2) 14.11.2016

Ruby on Rails Representational State Transfer (REST) Architectural abstraction for distributed systems The application is formed by resources Resources are identified by URL http://myapp.com/galery/2013 http://myapp.com/galery/2013/photo/42 Components of the application communicate over the network and exchange resource representations Representation is typically HTML, XML, or JSON The API is built over HTTP and is hypertext driven GET http://myapp.com/galery/2013 DELETE http://myapp.com/galery/2013/photo/42 REST philosophy is also adopted by other web languages (usually implemented by some framework), especially since the HTML5 come. by Martin Kruliš (v1.2) 14.11.2016

Node.js JavaScript Server-side Platform Basically a Google V8 JavaScript engine compiled as CLI script interpreter V8 is used in Chrome and it is the fastest JS interpreter Contains many pre-built packages for server-side application development (sockets, HTTP, …) HTTP server is embedded in the application, so the programmer may tune it for specific needs Aims for fast developed single-language solutions Using Javascript on client and server allows some level of code sharing Example 4 by Martin Kruliš (v1.2) 14.11.2016

Statistics https://w3techs.com/technologies/overview/programming_language/all, 13th of November, 2016 Other sources may give you different numbers (it is statistics after all); however, PHP was the leading technology in all surveys that I have seen. by Martin Kruliš (v1.2) 14.11.2016

Server-side Scripting Client-server Architectures Strict separation of two application parts Client - data presentation, user interface Server – business logic, data storage Both sides are connected via specific API (HTTP) The communication latency and overhead influence the application design Three-tier architecture Presentation (client), business logic (server), database (server, possibly dedicated machine) Thick client (Single Page Applications) Business logic is shifting to the client-side Three tier architecture allows also better scaling of server tiers. Database tier may be moved to a dedicated server or even replicated. Similarly, the business logic may be divided further in services running on different machines or even in cloud. by Martin Kruliš (v1.2) 14.11.2016

Server-side Scripting Specific Issues of the Server Side Traditional web applications Work in batches – client wants to perform a large task with each HTTP request Download a page full of formatted data Submit a form and generate a response Difficult state management (HTTP is stateless) Code replication and dependency injections Modern (single page) web applications Just a remote API for AJAX calls Difficult to integrate AJAX API into existing applications, or create applications that work both ways by Martin Kruliš (v1.2) 14.11.2016

Application Design Event-driven Desktop GUI Application Event Event Events are processed sequentially Event GUI Main Loop Background Processing Event All components can access main memory Operating Memory Application State by Martin Kruliš (v1.2) 14.11.2016

Application Design Web Application Event Database, Files, Session storage URL POST Data Application State Browser Application State Check integrity Event Batch-like processing New State Browsing, submitting form Processing Script Memory Serialization/deserialization, encoding, … by Martin Kruliš (v1.2) 14.11.2016

Web Design Patterns Front Controller Software design pattern that provides centralized entry point for all request (commands) All URLs point to the same script Method/function Class/file/module Initializing the libraries, setting up the container Action … Controller/Presenter … Front Controller (index.php) HTTP Routing and dispatching by Martin Kruliš (v1.2) 14.11.2016

Web Design Patterns Model-View-Controller Controller Database View Presentation Tier Business Logic Data Tier Controller Database View Model Invoking actions Dataflow by Martin Kruliš (v1.2) 14.11.2016

Web Design Patterns Model-View-Controller A guideline how to divide code and responsibility Basis for many frameworks Model Uniform data API for the application Communicates with DB/file storage/… Simplifies portability to other storage types Transparently handles encoding, integrity checks, transactions, data pre/post-processing, … by Martin Kruliš (v1.2) 14.11.2016

Web Design Patterns Model-View-Controller View User interface, data presentation Typically responsible for generating HTML Automatic sanitization of presented data (<,> chars) Translations for multilingual applications Templates Mechanisms that separate HTML coding from application programming Allow implementing View features (mentioned above) in declarative (instead of imperative) manner by Martin Kruliš (v1.2) 14.11.2016

Web Design Patterns Model-View-Controller Controller Integrates business (application) logic Issues commands to view and model Process user requests Requests for displaying content (typically GET request) Requests for modifying app. status (typically POST req.) Typically implements other design patterns Front controller, command, … Alternative – Model-View-Presenter More advanced form of MVC View is more separated and does not access model directly by Martin Kruliš (v1.2) 14.11.2016

Discussion by Martin Kruliš (v1.2) 14.11.2016