usecase framework and server-side state...

[Jörn Nettingsmeier <po...@uni-duisburg.de>]

hi all!

a while ago, we discussed and rewrote the changePassword and
changeAdminPassword usecases. it turned out that we needed two usecases,
because you cannot currently store state information across
continutations (i.e. you can't use a flag "adminMode=true", because you
would have to GET/POST it along, which could be tampered with and is
thus insecure).

a few days ago i met with wolfgang kaltz (who, as it turned out, works
in the same building as i do, about 50 meters from my office, which i
realized only weeks ago), and i asked him about this limitation.
he did not know for sure, but guessed it might have to do with the fact
that continuations must not become too large and are purged immediately,
so the lenya devs chose not to support server-side state when writing
the usecase framework.

now i'm reading the excellent book on cocoon2 by stephan niedermeier,
and i find that cocoon comes with a continuations-manager that allows
you to set time-to-live for continuations, which should take care of the
problem. so obviously there is some knack that i don't understand.

can anyone explain why the usecase framework does not allow server-side
variables? to me this seems to be the most important benefit of
continuations, and it seems quite odd not to be able to use it.


regards,

jörn


-- 
"Open source takes the bullshit out of software."
	- Charles Ferguson on TechnologyReview.com

--
Jörn Nettingsmeier, EDV-Administrator
Institut für Politikwissenschaft
Universität Duisburg-Essen, Standort Duisburg
Mail: pol-admin@uni-due.de, Telefon: 0203/379-2736


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org

Re: usecase framework and server-side state...

[Andreas Hartmann <an...@apache.org>]

Jörn Nettingsmeier wrote:
> hi all!
> 
> a while ago, we discussed and rewrote the changePassword and
> changeAdminPassword usecases. it turned out that we needed two usecases,
> because you cannot currently store state information across
> continutations (i.e. you can't use a flag "adminMode=true", because you
> would have to GET/POST it along, which could be tampered with and is
> thus insecure).
> 
> a few days ago i met with wolfgang kaltz (who, as it turned out, works
> in the same building as i do, about 50 meters from my office, which i
> realized only weeks ago), and i asked him about this limitation.
> he did not know for sure, but guessed it might have to do with the fact
> that continuations must not become too large and are purged immediately,
> so the lenya devs chose not to support server-side state when writing
> the usecase framework.

The actual reason was that Usecase handler classes were designed as
Avalon services, which have to be released before the response is sent.
Now I wouldn't do it like this anymore. We could change it, though this
would make the code a little more complex because we can't delegate all
the component handling work to the framework.

There were some threads about usecase handlers as POJOs, you might
want to take a look at them. However, it's fine with me to change it.

-- Andreas


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org