Facebooker talk - Feb 2009 - Flex, facebooker, and sessions not being maintained

I have a Flex based SWF being loaded with FBML into my facebook
application.   When the application is initially loaded and the SWF is
served up, a rails session is created.  At that request, I have a full
facebooker session object and everything is fine.

However, on any subsequent *flex* requests back to our API (using
httpservice), it doesn''t maintain that initial session setup when the
application first loaded.  It creates a new session, and the fb_sig
parameters are no where to be found.

If I do a full browser refresh of the page though, it goes back and uses
that initial session that was created when the app first loaded.  It would
appear that the browser is working with rails correctly to maintain the
session, but since Flex doesn''t send http calls through the browser
that
way, it gets a new session any time it makes a call by itself.

Any ideas on how to go about making the Flex app be able to talk back to the
rails app and use the same initial session that was created upon loading the
app?
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/d5a047c7/attachment.html>

Brian,

Chances are that the problem is a little weirder than you think.

All calls that Flex makes should seem to originate from the same page the app is
embedded in.  So if you''re talking about the session being stored in
the cookies, then you''re relying on the browser''s cookie
policy to get it right for you.

Is this what you mean by ''session'' - the Rails cookie-based
session data?

I can give you some pointers on how to make it work correctly if that''s
what''s happening.  (Hint:  Don''t rely on cookies at all.)

-Aaron




________________________________
From: Brian Culler <brian at brianculler.com>
To: facebooker-talk at rubyforge.org
Sent: Monday, February 9, 2009 8:47:38 AM
Subject: [Facebooker-talk] Flex, facebooker, and sessions not being maintained

I have a Flex based SWF being loaded with FBML into my facebook application.  
When the application is initially loaded and the SWF is served up, a rails
session is created.  At that request, I have a full facebooker session object
and everything is fine.

However, on any subsequent *flex* requests back to our API (using httpservice),
it doesn''t maintain that initial session setup when the application
first loaded.  It creates a new session, and the fb_sig parameters are no where
to be found.

If I do a full browser refresh of the page though, it goes back and uses that
initial session that was created when the app first loaded.  It would appear
that the browser is working with rails correctly to maintain the session, but
since Flex doesn''t send http calls through the browser that way, it
gets a new session any time it makes a call by itself.

Any ideas on how to go about making the Flex app be able to talk back to the
rails app and use the same initial session that was created upon loading the
app?



      
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/a96db456/attachment.html>

We''re using ActiveRecordStore for session management.  So the session
data
is actually being saved in the database I believe, and all that is going in
the cookie (should be) the session ID.

I have no idea why that session ID is not getting sent.  So as a work
around, we included the session ID into the Flash Vars that get loaded into
the SWF with the fb:swf tag.  Then our Flex app appends the _session_id to
every call back to the rails server.  This forces the rails app to use the
correct (original) session.

Thanks!

On Mon, Feb 9, 2009 at 4:12 PM, Aaron Nemoyten <swivelmaster at
yahoo.com>wrote:
> Brian,
>
> Chances are that the problem is a little weirder than you think.
>
> All calls that Flex makes should seem to originate from the same page the
> app is embedded in.  So if you''re talking about the session being
stored in
> the cookies, then you''re relying on the browser''s cookie
policy to get it
> right for you.
>
> Is this what you mean by ''session'' - the Rails
cookie-based session data?
>
> I can give you some pointers on how to make it work correctly if
that''s
> what''s happening.  (Hint:  Don''t rely on cookies at all.)
>
> -Aaron
>
>
> ------------------------------
> *From:* Brian Culler <brian at brianculler.com>
> *To:* facebooker-talk at rubyforge.org
> *Sent:* Monday, February 9, 2009 8:47:38 AM
> *Subject:* [Facebooker-talk] Flex, facebooker, and sessions not being
> maintained
>
> I have a Flex based SWF being loaded with FBML into my facebook
> application.   When the application is initially loaded and the SWF is
> served up, a rails session is created.  At that request, I have a full
> facebooker session object and everything is fine.
>
> However, on any subsequent *flex* requests back to our API (using
> httpservice), it doesn''t maintain that initial session setup when
the
> application first loaded.  It creates a new session, and the fb_sig
> parameters are no where to be found.
>
> If I do a full browser refresh of the page though, it goes back and uses
> that initial session that was created when the app first loaded.  It would
> appear that the browser is working with rails correctly to maintain the
> session, but since Flex doesn''t send http calls through the
browser that
> way, it gets a new session any time it makes a call by itself.
>
> Any ideas on how to go about making the Flex app be able to talk back to
> the rails app and use the same initial session that was created upon
loading
> the app?
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/548b7721/attachment-0001.html>

Okay, well, you actually are doing what I was going to suggest anyway, so there
you go.

It''s important to understand WHY you need to do that though!  

Basically the cookie policy of the browser you''re using is preventing
the cookie from being sent with the initial request.  It''s probably
Safari - it does this weird thing where it DOES set A cookie with the right key
but not the right value.  Then when you try to check for the cookie''s
existence, yeah it''s there, but there''s no session associated
with it so nothing works.

The only workaround that will always work (as far as I''ve figured) for
iFrame apps is NOT TO RELY ON COOKIES AT ALL, EVER, EVER, no matter how you
think you''ve conquered the issue.

What''s nice is that we''ve been using a class designed for our
own web service calls, so fixing the session id issue was a matter of modifying
that class to add it to XML requests and/or GET params and setting a static
variable when the app starts up based on the flash vars.

Another thing to note is that FileReference.upload() will not ever send browser
cookies from the current tab/window/session, so even if you think
you''ve got cookies covered (IE you''re not in an iFrame) and
you''re using them to track sessions, this will still force you to come
up with another way to authenticate requests if you want users to be able to
select and upload files.  Lame.

-Aaron




________________________________
From: Brian Culler <brian at brianculler.com>
To: Aaron Nemoyten <swivelmaster at yahoo.com>
Cc: facebooker-talk at rubyforge.org
Sent: Monday, February 9, 2009 4:02:21 PM
Subject: Re: [Facebooker-talk] Flex, facebooker, and sessions not being 
maintained

We''re using ActiveRecordStore for session management.  So the session
data is actually being saved in the database I believe, and all that is going in
the cookie (should be) the session ID.

I have no idea why that session ID is not getting sent.  So as a work around, we
included the session ID into the Flash Vars that get loaded into the SWF with
the fb:swf tag.  Then our Flex app appends the _session_id to every call back to
the rails server.  This forces the rails app to use the correct (original)
session.

Thanks!


On Mon, Feb 9, 2009 at 4:12 PM, Aaron Nemoyten <swivelmaster at yahoo.com>
wrote:

Brian,

Chances are that the problem is a little weirder than you think.

All calls that Flex makes should seem to originate from the same page the app is
embedded in.  So if you''re talking about the session being stored in
the cookies, then you''re relying on the browser''s cookie
policy to get it right for you.

Is this what you mean by ''session'' - the Rails cookie-based
session data?

I can give you some pointers on how to make it work correctly if that''s
what''s happening.  (Hint:  Don''t rely on cookies at all.)

-Aaron




________________________________
 From: Brian Culler <brian at brianculler.com>
To: facebooker-talk at rubyforge.org
Sent: Monday, February 9, 2009 8:47:38 AM
Subject: [Facebooker-talk] Flex, facebooker, and sessions not being maintained


I have a Flex based SWF being loaded with FBML into my facebook application.  
When the application is initially loaded and the SWF is served up, a rails
session is created.  At that request, I have a full facebooker session object
and everything is fine.

However, on any subsequent *flex* requests back to our API (using httpservice),
it doesn''t maintain that initial session setup when the application
first loaded.  It creates a new session, and the fb_sig parameters are no where
to be found.

If I do a full browser refresh of the page though, it goes back and uses that
initial session that was created when the app first loaded.  It would appear
that the browser is working with rails correctly to maintain the session, but
since Flex doesn''t send http calls through the browser that way, it
gets a new session any time it makes a call by itself.

Any ideas on how to go about making the Flex app be able to talk back to the
rails app and use the same initial session that was created upon loading the
app?


      
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/c0140c70/attachment.html>

Aaron, I''d appreciate any pointers you might have on sessions in this  
case.

Cheers.


On Feb 9, 2009, at 1:12 PM, Aaron Nemoyten wrote:
> Brian,
>
> Chances are that the problem is a little weirder than you think.
>
> All calls that Flex makes should seem to originate from the same  
> page the app is embedded in.  So if you''re talking about the
session
> being stored in the cookies, then you''re relying on the
browser''s
> cookie policy to get it right for you.
>
> Is this what you mean by ''session'' - the Rails
cookie-based session
> data?
>
> I can give you some pointers on how to make it work correctly if  
> that''s what''s happening.  (Hint:  Don''t rely on
cookies at all.)
>
> -Aaron
>
>
> From: Brian Culler <brian at brianculler.com>
> To: facebooker-talk at rubyforge.org
> Sent: Monday, February 9, 2009 8:47:38 AM
> Subject: [Facebooker-talk] Flex, facebooker, and sessions not being  
> maintained
>
> I have a Flex based SWF being loaded with FBML into my facebook  
> application.   When the application is initially loaded and the SWF  
> is served up, a rails session is created.  At that request, I have a  
> full facebooker session object and everything is fine.
>
> However, on any subsequent *flex* requests back to our API (using  
> httpservice), it doesn''t maintain that initial session setup when
> the application first loaded.  It creates a new session, and the  
> fb_sig parameters are no where to be found.
>
> If I do a full browser refresh of the page though, it goes back and  
> uses that initial session that was created when the app first  
> loaded.  It would appear that the browser is working with rails  
> correctly to maintain the session, but since Flex doesn''t send
http
> calls through the browser that way, it gets a new session any time  
> it makes a call by itself.
>
> Any ideas on how to go about making the Flex app be able to talk  
> back to the rails app and use the same initial session that was  
> created upon loading the app?
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/14b3cbba/attachment.html>