Please apologize for the first design draft, as it’s not finished at all.

I realized recently that it was far from being true. While frameworks and ORMs make web developers’ job easier and easier, more and more people comes to develop websites without knowing about the real basics. They use relational databases without knowing anything about SQL, and they develop websites without understanding how the client will talk with their website.

I don’t pretend to make a revolution there, but if I bring my car to the car mechanic, I hope he will know a bit more about it than “engine makes power, and so the car is working”. So are my exigences when I ask a specialist to work on a website.

To give a parallel with playing music, you can learn to play some songs without knowing anything about harmony and rhythm, but is you want to get serious about what you play, it will become an absolute requirement.

I so decided to make some short articles explaining in simple terms what those basis are, to my humble opinion. First one is about HTTP.

So what is HTTP ?

HTTP is a communication protocol that comes at application level. In easier terms, it means that it’s a language that allows two applications to communicate by exchanging messages. How those messages will transit between the two applications is not HTTP purpose, and in a network-less world, you can even imagine exchanging messages on floppy drives. In the real world, we prefer make it transit over networks, using some low levels network protocols like TCP/IP.

As it’s true 99% of the time, we will assume it’s always true: HTTP is the communication language, TCP/IP will handle the transport of HTTP messages between actors.

Let’s go back to the original definition.

HTTP 1.1 (the last protocol version) is defined by RFC 2616, which says:

The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative, hypermedia information systems. HTTP has been in use by the World-Wide Web global information initiative since 1990.

…

The HTTP protocol is a request/response protocol. A client sends a request to the server in the form of a request method, URI, and protocol version, followed by a MIME-like message containing request modifiers, client information, and possible body content over a connection with a server. The server responds with a status line, including the message’s protocol version and a success or error code, followed by a MIME-like message containing server information, entity metainformation, and possible entity-body content.

This is the absolute minimum to know. HTTP is a communication language, and works in a request-message, response-message way. This is extremely simple. The RFC then explain that it can do much more complicated things, like handling messages that will go through many nodes before reaching destination, but let’s keep it simple, and say that from a client or server point of view, it will result in exactly the same thing.

The RFC also makes clear that HTTP is not dependent on the transport mean:

HTTP communication usually takes place over TCP/IP connections. The default port is TCP 80, but other ports can be used. This does not preclude HTTP from being implemented on top of any other protocol on the Internet, or on other networks. HTTP only presumes a reliable transport; any protocol that provides such guarantees can be used; the mapping of the HTTP/1.1 request and response structures onto the transport data units of the protocol in question is outside the scope of this specification.

And it will be out of the scope of this blog post too. HTTP doesn’t care about how the message transport is done, but it’s usually handled by TCP/IP.

Messages, requests, responses

So the basic communication tool will be messages. A client to server message is called a request, and the server to client “answer” is called a response. Even if it may seems obvious, a response cannot be the server initiative: a client must have made a request, and server response is the response to this request.

Now we’re pretty confident about HTTP messages being Tupperware boxes containing informations. Let’s make a step forward and look at how this box content is structured.

Messages consists of three parts: the start line, the headers, and the body. As each part has specific rules depending on if the message is a request or a response, we’ll have a look at both separately.

The request

The request start line is pretty easy to understand, it will tell the server what we are requesting.

GET /path/to/file/index.html HTTP/1.0

Here it tells we’re using HTTP GET method, to retrieve resource located at the /path/to/file/index.html URI (uniform resource identifier). It also contains what protocol variant we’re using, to be sure we speak the exact same language.

I will come back a bit later on what are HTTP methods, and will refer them as “methods” from now on.

After this, the client will send the headers. Headers are a key-value list of properties, that transmit various informations about the client, it’s capabilities, what it’s expecting, and the message itself. I won’t go over every standard request headers.

Depending on what method is used, the request’s body may or may not contain data. For example, if we simply get google’s homepage, it won’t contain any data. If we’re uploading a file, or POST-ing form data to the server, the body will be those data container.

The response

Once server received the request, it will pass it to a handler, which can be about anything. In PHP applications, hosted on an apache server, chances are that apache will call mod_php to handle the request, and build a response it will send back to the client. But that’s only one possibility amongst a huge infinite list, which is outside the scope of this blog post.

Anyway, the handler takes an http request as its input, and builds an http response, starting by the response start line.

HTTP/1.0 200 OK

This is a pretty standard response. Server starts by saying which protocol variant it’s using, then sends a computer readable status code, followed by an human readable translation of this status code.

A complete list of HTTP status codes is available at many places on the internet, and it’s useless to know them all. Googling “http status code” when you’re looking for the adequate status should be far enough.

The most important thing to know is the different status code classes, defined by the first digit of the code:

• 1xx: Informational – Request received, continuing process.
• 2xx: Success – The action was successfully received, understood, and accepted.
• 3xx: Redirection – Further action must be taken in order to complete the request.
• 4xx: Client Error – The request contains bad syntax or cannot be fulfilled.
• 5xx: Server Error – The server failed to fulfill an apparently valid request.

Some practical direct application of this is when you need to choose between sending back a 404 error and a 500 error. 404 is client’s fault. He asked for something that does not exist, and you tell him so. No problem. 500 means that server tried hard to build a response, but something forbid it to achieve its goal. This is a server-side application problem, and you should monitor, and correct this as soon as possible.

After sending the start line, the response, being a faithful HTTP message, will go on by sending the headers. Like for the request, headers will give informations about the server and the message content. You can consider it as the README file that will help the user agent (http client software) to understand the response.

Then, the response message will often contain a body (unless you’re using some method requiring not to have it), and the most seen cases are either HTML content, XML/JSON (or similar) response that will be treated by a client-side web application (flash, javascript, …), or binary content (for a file download, for example).

HTTP methods

What is it? Beside being one word in the request start line, the HTTP method is the client’s way to tell the server what kind of operation it wants to perform on the resource requested. The method used in a request have direct implications on what kind of work you can do server-side, and should be choosen carefully (of course, you can break this rule, but it’s a very bad idea).

Safe methods

Some methods are said “safe”. This means that request is a retrieval operation, and should not do any other work. Notice that “should” does not mean “must”, but user cannot be held responsible for breaking something if the method used was “safe”.

For example, you should not allow GET methods to create, delete or change files, database records, or LDAP nodes (non exhaustive, of course).

This is the case of GET and HEAD methods.

Idempotent methods

Idempotents methods are those which won’t have any side-effect if repeated more than once.

For example, the DELETE method, which asks for a resource deletion, should have the exact same effect if it’s called only once on resource A, or if it’s called ten times. The overall effect should be the resource deletion (if allowed), not less, not more.

This is the case of GET, HEAD, PUT and DELETE methods.

Non-safe and non-idempotent methods

But of course, some requests needs to take risky and/or non-repeatable actions server side. When an user agent uses such a method, he will be aware of the risks.

For example, POST-ing a comment will create a database record, and if you make twice the same request (unless some protection has been developed to prevent this), you will actually create two database records.

It’s the exact reason why browsers ask for user confirmation before repeating a POST request, if user asks for a refresh. It’s also the reason why you should redirect to a safe idempotent resource after a successful form submission, to forbid user to be able to repeat request.

This is the case of POST method.

And the real world

All those methods are defined by the HTTP RFC, but the real world is much more restricted than that. In fact, modern browsers only support GET and POST methods, so you should only care about those.

You should just keep in mind that other HTTP methods exist, and for example HTTP extensions like WebDav (which is used by microsoft and their “online folders”) use them. A simple way to try out PUT, DELETE, or any other method is to use curl as an http client.

To learn more about specificities of all methods, you can still refer to the original RFC.

Example

The request…

GET /index.html HTTP/1.1
Host: www.example.com

Nothing complicated here, but for curious people (and you should be curious):

• example.com is a special domain reserved by the RFC 2606. This domain won’t bring any conflict with a real domain, never. You should use it for all your tests and examples.
• The “Host” header is required by HTTP 1.1 protocol, and is used by web servers to provide name based virtual hosting of different websites on the same IP address.

and the response!

HTTP/1.1 200 OK
Date: Sun, 24 Jan 2010 22:38:34 GMT
Server: Apache (Boubounetout/Linux)
Last-Modified: Fri, 01 Jan 2010 23:11:55 GMT
Etag: "f3f80-1b6-de1b034b"
Accept-Ranges: bytes
Content-Length: 438
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
  <head></head>
  <body>
    <h1>Welcome</h1>
    <p>Hello, world!</p>
  </body>
</html>

Conclusion

I hope that I’m far from being alone claiming that this is the very basis of any serious web development, and that it will makes your web developer life easier just because you understand the underlying communication language. Yes, HTTP is definitely the web’s language, and you should be aware of it.

Ok folks, this will be all for today. But keep tuned, next episodes are already in the pipes.

Thanks to Bertrand Zuchuat for giving feedback and ideas before the article publication.

Little sum up of new features:

• Symfony cache is now used in debug mode too, but it checks assets modification timestamps to know if a recompilation is needed. This timestamp check is not done in non-debug mode, to avoid overhead.
• An asset filter chain, fully configurable, extensible and backward compatible is now there. The process is pretty simple: you can write subclasses of sfDynamicsBaseAssetFilter to implement your last great idea about assets filtering. Then, just register it in your app.yml under the section sfDynamicsPlugin/concatenated_javascript_filter_chain (or the same with stylesheet). A full working example is available on the new application configuration page, that describe all app.yml configuration directives. By the way, the default asset filtair chain is exactly the same as before.
• To demonstrate this new feature, a sfDynamicsExperimentalClosureAPIJavascriptFilter class has been added. It is an asset filter that calls the Google Closure Compiler API, via an HTTP POST request. Of course, it is not a good idea to do so on a «real» website, but this class is here for demonstration purpose.
• Along with the new documentation page, a set of configuration values that were guessed depending on if you are in debug mode, or not, are now configurable via the app.yml of each applications. Of course, the default value is fully backward compatible.
• Last feature, which is more polishing than a feature, is that your project won’t show up if the sfDynamics module is disabled but required for some assets. Instead, an exception will explain what’s missing.

All those features are tested since a few weeks, and a simple cache:clear after upgrading the plugin should keep your project in a nice state. Or at least, I hope so…

The global goal of this release is to tend towards 1.0, by making all existing features configurable and extensible, so that 1.0 branch will be able to remain stable and 100% backward compatible for a long time.

See you space symfonists!

Here is a real story case study of a BC break that happened on the PHP language itself.

It’s always tempting to say «hey, this feature is so great, and has so little impact on the way it works, it may be cool to include it it the stable branch, don’t you think?». Well, it can be cool, if it cannot have any effect on existing projects. But let’s think again. How can it have no effect on the existing projects? And if it has no effect, why include it in this branch?

I don’t think there is a definite answer to this, as it may have pros sometimes. But most of the time, it will have much more cons than pros. And if you doubt, forget it. Bigger is the project you work in, more it will have users depending on it, and if there is any way users could have used the old “buggy” feature, for sure they did.

I want to expose some real life case that happened recently, on the PHP distribution itself, showing its snowball effect through symfony to real life projects.

Let’s have a look at this php bug report. It says «spl_autoload_functions() should return object instances, not class
names, when appropriate.»

Two words are really interesting in this bug report. It is “should” and “when appropriate”. There is many assumptions behind this. When is this “appropriate”? Why “should” it return instances? I would better rephrase it as «Feature request: spl_autoload_functions() must return object instances, as it is more appropriate than strings containing class names.». The overall formulation is not so much important as the facts that:

• it is a feature request, not a bug
• the function is currently working, but its behaviour can be changed to a more convenient one.

But it’s ok, right? The target version was 5.3 while still no stable releases existed.

Yes it is.

Oh wait, let’s read the comments now.

«Thanks for the fix. Do you think, by any chance, we can sneak this into PHP 5.2, or is that impossible?»

The definite answer to this question should be «It is actually impossible. Introducing a behavior change into 5.2 (years) stable release would break backward compatibility.»

And the patch made it to PHP 5.2.11.

Is there any consequences? Yes of course. In fact any symfony 1.3 projects were broken at this stage, because symfony used this behaviour with the reintroduced sfAutoloadAgain autoloader, which checked the return value for strings, and got instances, causing an infinite loop that made apache segmentation fault.

This is now fixed, by http://trac.symfony-project.org/cha…, but was the feature worth the hassle? How many projects can this kind of change break?

So for all you that work on big projects, think well, then think again, then don’t do such a change. Usual formula says «With great power comes great responsibilities». I’d add «Great notoriety induce great responsibilities».

Yes millions of people uses PHP, and that’s the main reason why stable branch should stay stable. Rock solid stable.
And it’s the same reason why symfony branches stay stable, as much as possible. And any exception to this always have bad feedback.

(thanks to Pierre Joye for his reminder at http://news.php.net/php.internals/4…)

Note: Software stability does not only mean bug-free. It also means «not changing», and it’s the main definition used there. Bugs are annoying, but they can be fixed to get the wanted behavior back, so it’s not a problem. And the only wanted behavior of a stable piece of software is the behavior it always had.

I’m very happy to get more and more comments and feedback about sfDynamics. I sure know it’s not perfect, but seeing it’s really usefull for other people than me and my colleagues is rewarding.

But I’ve also been so busy lately that I did very few writing and coding work around it, so I’ll write about last months work, and about the future road-map.

• I moved all my plug-ins ticketing from their different homes (lighthouse for sfDynamics, and symfony-project’s trac for the others) to a brand new redmine instance I set up on trackeet.org. This will greatly enhance how I can see the issue list, prioritize and assign different stuff to people willing to help. Additionally, it helps cleaning up symfony-project’s trac instance which suffers from plug-in issues since a long time.
• I fixed the easiest issues, and they’re packaged into the 0.9.4 release.
• Since 0.9.2 release, we don’t support anymore symfony 1.1, as the routing system was radically different and way less power-full.
• After I released 0.9.4 this week, next step will be a documentation clean-up, and some tutorial writing. Yes, the fourth part is still missing, and it will come to life very soon.
• Upcoming 1.0 release will support symfony 1.2, 1.3, and 1.4. The aim for this release is to fix all 0.9 tickets that are not radically new features. A refactoring session before the first 1.0 release will be planned.
• Next 1.1 version will at least support symfony 1.4, and if it’s possible 1.2 and 1.3 too. But the main goal will be to stick to the next LTS symfony version, which will be 1.4.

I know, no dates were given on this page, but the new roadmap page solves this.

Some more news soon…

• sfDynamics homepage & documentation
• sfDynamics issues

sfDynamicsPlugin is a flexible assets manager for symfony which can be used to
manage javascript libraries and their associated stylesheets. It supports
packing, and CSS minifying, while keeping the full readable source in development
environment.

Finally out

After more than one year of thinkings about the right way to manage
dependencies and relations between dynamic components, and a few months of
intermitent coding, I’m proud to present sfDynamicsPlugin.

Look at the plugin’s page at symfony project

Features at a glance:

• JS framework agnostic
• Built-in assets cache/supercache
• Flexible XML configuration of packages
• Dependencies/conflict management
• Ease of use within plugins without repeating JS code
• Built-in configuration for the most used frameworks including jQuery, jQuery UI, ExtJS, Prototype and Scriptaculous.

Use what you like

To give some more details about the last feature, those are bundled as
non-default configuration files, that you may, if you want, import in your
project/app/plugin dynamics configuration file.

By doing so, there is absolutely no parsing overhead, as unused configuration
files will be, he, unused.

Documentation, documentation and even more documentation!

As documentation is very important, full documentation is available both in
markdown and HTML versions, along with a
tutorial
and a short hello world example.

• Give me the tutorial
• Take a look at the full HTML documentation
• I’m a warrior, give me the MarkDown

Reporting bugs, suggesting features

We use lighthouseapp as our ticketing system.
Don’t hesitate to report bugs, we’re looking forward to make this plugin a
«YFast» answer to highly dynamic websites.

Ok, show me the issues…

This is an attempt to take over the first place on google for the query how to render component action symfony.

Restrict mode

«Better do nothing than something stupid.»

The default behaviour is ON DELETE RESTRICT. This is the most secure setting, so it is normal to have it as default.

If we try to DELETE a record referenced by the current object, the database engine just raise an SQL error. If it was not
an error to DELETE this, you will have to start by removing the linked object, or setting the foreign key value to something different.

Cascade mode

«No need to keep obsolete things.»

But our database engines are able to do better. For example, if you have an user’s settings table and you delete an user, you may not wan’t
to keep his settings. You just set ON DELETE CASCADE on user’s setting foreign key column referencing the user table, and if a user is ever deleted, all his associated properties will be destroyed.

Along with ON DELETE CASCADE, we usually add a NOT NULL constraint (or required: true), as the existence of current object is directly
related to the existence of linked object. This may be wrong from time to time, but it is usually the case.

Set null mode

«We don’t rely on this. Just forget it.»

The last behavior is the ON DELETE SET NULL option. It does exactly what it says. If linked object is removed, we set our foreign key
value to null.

This the behavior you may want to use for articles having a link to their author for example. If the author is removed from database,
we don’t want to delete his articles, so we just loose the author information (well ok, this is a simplification, but it basically shows
the idea).

Why I think we should explicitly use it

The default database engine behavior is «I don’t know how to handle it». Setting it will add power to your database model, while taking
profit of your RDBMS features. Not setting it is like saying «I don’t know which way I want my database to behave in case we delete a linked
object», and that’s like saying «I don’t know how I want my model to react». Thinking a little to understand which way you want it to work
will make you certain you’re understanding the behavior you need in your project.

How to set it in your favorite ORM:

schema.yml with Doctrine

Article:
  columns:
    title:   string(255)
    body:    string(4096)
    user_id: integer(4)
  relations:
    User:
      onDelete: CASCADE

PHP model with Doctrine

schema.yml with Propel

    data_id:  { type: integer, primaryKey: true, foreignTable: data, foreignReference: id, onDelete: cascade, onUpdate: cascade }

schema.xml with Propel

A lot of nice new features are greatly awaited in the next version.

First of all, the admin generator will be completely rewritten, to make a good use of the new form framework. That will for sure open incredible new possibilities and remove the permanent need for hacks to customize your own admin interface (or frontend interface, if you do use admin generation in frontend too). At least, the first one amazed more than one person, and we can be pretty sure that new version will kick asses.

Some people were complaining about Ruby on Rails having a great advantage over symfony, by their deployment tool Capistrano, while symfony only allow to rsync to one server. Hopefully this won’t be true for long anymore. For information, Capistrano allows to create real deployment scripts, like “Disable frontend app on this server, make backups of site and database, synchronize, remotely run tests, clear the cache and enable the frontend app”. That will easify a lot our projects delivery procedures.

Amongst some other details, the last major point Symfony 1.2 will see is some further decoupling of the technical choices symfony 1.0 gave us, like Propel or Prototype. Prototype and the helpers will still be bundled with symfony, but as a plugin, like Propel is since 1.1. This is very important IMHO, because symfony should never force any technical choice to the teams. But many people complained that helpers was one of the easy and magic things that attract newcomers to symfony. The plugin solution is keeping everyone happy. In the same spirit, symfony 1.2 will bundle the sfDoctrine plugin thanks to Jonathan Wage work to stabilise and manage branches/features.

And for the short term, the unpublished chapters of the form framework online book are still to come too, along with a symfony 1.1 “First project” tutorial.

Long life to symfony

Documentation?

Many people are complaining about the fact it lacks documentation. In fact, it seems that many people fears that because François announced he was leaving the symfony core team, nobody would take care of documenting the project.

But that’s something any big open-source project come to see one day, a former or important team member leaves the project, because he or she doesn’t have anymore time for it, differ views, change interest, or whatever else.

As he said, no-one is irreplaceable, and new people comes in too, hopefully. Developpers from many countries started recently to fix and translate existing documentation for symfony 1.1, a new mailing list is being created for documentors and the symfony core team is currently putting a great effort on it too.

Documentation!

The symfony documentation page is split by version and language, and the 1.1 english version is getting attention to adapt parts of it in the need. But even without that, if you know symfony 1.0 pretty well, you should not have hard time to updating, as every changed part were because they were judged too complex, or not “clean” enough. The new way to do things is usually easier.

To demonstrate it, people from symfony core team published a little serie of articles on symfony-project.org recently:

• Nicolas Perriault published an article about form internationalization, something you could not do to do so easily with symfony 1.0 helpers.
• Fabien Potencier demonstrated how handy was the new sf_format feature, to provide the same logical content within different formats, or for instance, different views. He also explained how to customize a project’s directory structure, showing the use of ApplicationConfiguration and ProjectConfiguration classes.
• Carl Vondrick explained how to use Propel 1.3 to boost your ORM layer performances (be aware though that PHP 5.2 is needed, while symfony 1.1 only requires PHP 5.1.4).
• I published two little tutorials about sending emails and using tasks.

And more are to come, of course!

And about forms?

The only part of symfony which needs a bit of learning is the new form framework, which is quite radically different from the 1.0 way to create form. And about this, Fabien recently announced he will publish an entire book about it.

To migrate or not to migrate

Symfony 1.0 is Long Term Support version, which means that symfony team will go on fixing bugs for three years since the original release. If your project is nearly released or already released, I would not bother upgrading, because you would not benefit of symfony 1.1 new features, while you’d suffer the upgrade process.

On the other hand, if your project is very young, I think the time to take the step is now, the official 1.1 release being real soon. You’d benefit of all new features with a very active community and a very reactive development team.