Web Application Using jqGrid with Delphi

POST #016
=======================================================================
Rather than just dabbling around a handful of jqGrid demos examples, I recently spent a few hours building a quite simplistic project using jqGrid with mORMot. I found that functionalities like "remote paging", "remote sorting" and "remote multi-searching" are working fine.


Remote paging is fine but I would like the grid will automatically postback to the server when end-users select a row and will fire the RowSelecting event handler and databind a second grid with details. I have tested more complex events, such as a subgrid. It's so fast and beautiful.
I had to use boils down (to do a MacGyver) to handle master detail and subgrid with mORMot with jqGrid. Technically everything goes pretty well.
 

Tags: Remote Filtering with jqGrid and Delphi; jqGrid with Delphi mORMot; Master detail grid with jqGrid and Delphi mORMot; subgrid with jqGrid and Delphi mORMot;Delphi Restful.

Remote Paging and Sorting using Delphi with ExtJS

POST #015 ========================================================================
In this mini-video, a remote RESTful access of a SQLite3 database, hosted by a mORMot server, with this dedicated server it was possible to do remote paging and remote sorting as well as CRUD operations with the ExtJS Grid.

Recently I was playing with mORMot and ExtJS when I came across a major block, the solution of which I now wish to share through this tip. While working with ExtJS at Client side and JSON objects returned on the server side (here mORMot), I found that all functionalities were working fine except remote filtering. It is quite well-known that mORMot supports sorting as well as paging.

Please note:
=========
- the docked pagination toolbar at the bottom of the screen.
- the results are sorted by Name in ascending / descending order.
- the pagination and sorting is being done remotely at server side.
- Filtering: has been done LOCALLY at client side.
- Table SampleRecord has 52,500 records

Best regards,

warleyalex from Sete Lagoas, Brazil


Tags: Remote Paging; Remote Sorting; ExtJS with Delphi; Remote Paginator; CRUD with Delphi and ExtJS; Extjs with mORMot;

Remote Filtering using Delphi with ExtJS

POST #014
=======================================================================

Sometimes, you only need a specific subset of data from your dataset, but you need it filtered to a specific set of Records. After working with our filtered dataset, there will come a time when we want our original dataset back. When we filtered the dataset, the other Records didn't go away. They're still sitting in cache, to the side, waiting to be recalled. Rather than query the server again, we can simply clear our filter.

Client-side filtering is great, reducing our trips to the server. Sometimes, however, our record set is just too large to pull in at once. A great example of this is a paging grid. Many times we'll only be pulling in 10 Records at a time. The client-side filtering methods just are fine if we only want to filter the resident dataset, but most of the time we'll want a filter applied to all of our data.

Sorting data on remote calls is pretty easy, using Extjs, as we can set the property remoteSort to true (default value is false) and the proxy will pass the filter object as the parameter:

filter:[{"property":"subject","value":"mORMot"}].

So, basically if our Store was attached to a grid object, clicking on a column heading to sort the display would automatically pass the parameter value in its AJAX request, and our little server mORMot should be well enough to handle these request.

Filtering data on remote requests is a bit harder. We would pass parameters through the Store's load event, and act on those arguments in our mORMot server-side method. Our little mORMot should read the parameter filter (a json object) and perform the filtering on server side. The problem is: our mORMot uses another approach to filter data – it uses inlined parameters via SQLwhere and cannot read directly with parameter Filter coming from the client side.

This might look complicated, but it really isn't! Again, our mission here is to learn how mORMot handle with this task, it is important to have some understanding of what your server-side process is doing. The trick is: what we have to do here is just passing some expected parameters related to filtering using inlined aproach through HTTP request, mORMot will just ignore the option parameter filter.


Regards,

warleyalex from Sete Lagoas, Brazil


Tags: Remote Filtering with ExtJS; Remote ComboBox Filtering with Extjs; ExtJS with Delphi mORMot; remote Filter with Extjs and Delphi;

Remote Reports using Crystal Reports + ExtJS + DataSnap

POST #013 ========================================================================
In this mini-video, a dedicated server reports using the DataSnap architecture, it was possible to take reports created with Crystal Reports XI - using thin clients (ExtJS).

Using reports created in Crystal Reports, traditionally in Delphi customers, is a very boring task, shall be installed at hundreds of libraries on clients, beyond the concern with updating reports. RPT on each client. license costs...

In this approach, the Crystal Reports were stored on the server-side (where the reports are processed), the "thin clients" just ordering reports, passing parameters - does not require installation. With this, the Crystal Reports could be called on different platforms. Pretty nice, isn't it?

Regards,
warleyalex from Sete Lagoas, Brazil


Tags: Crystal Reports with ExtJS; ExtJS with Crystal Reports; datasnap with Crystal Reports; Datasnap with Extjs; Extjs Reporting;

Delphi + ExtJS + Firebird = CRUD

POST #012 ========================================================================
Delphi XE introduced the ability to build DataSnap servers to work with an HTTP REST interface.
On client side, there's a powerful framework called ExtJS.
I would like to make CRUD operations (create, Read, Update, Destroy) using these outstanding technologies.

So I've decided to mix {Delphi + Firebird + ExtJS 4+} up to see what would happen. I've looking for a trully RAD tool that would save me the time to develop a thin client JS, to create user interface and so on, I've found a tool called Sencha Architect, I love the way straightforward and sturdy you can do something with this tool, you can invoke remote methods from Delphi using REST interface. That's so beautiful.

warleyalex from Seven Lakes, Brazil.

Tags: crud with delphi and extjs; sencha architect with datasnap; crud com datasnap and extjs;

JAVASCRIPT AUTHENTICATION WITH DELPHI REST SERVER

POST #011 ============================================================================= 
Has anyone done Javascript authentication with a Delphi REST server application?

It makes sense to ask about authentication, since without authentication anyone will be able to connect to your web server and execute all server methods available.

In this mini-video, it shows the DataSnap authentication scheme and  mORMot using the HTTP transport layer. My first webservice using the framework mORMot.

AUTHENTICATION SCHEME WITH DATASNAP:

The DataSnap authentication scheme is the awful "Basic Authentication". This scheme is used by most web services (about 95% of webservices).

It is available by default "native" in all browsers, but has some known weaknesses, such as a) that terrible authentication window displayed by browsers b) no appeal to have the feature "logout-like" and c) the fact that the username and password are transmitted "in plain text" to the server (it would be safer to leave the password only stay on the client side, while the keyboard input, and be stored as a hash in secure Server).

The first time a JS client calls the DataSnap REST server, it creates a new session ID and returns it in a custom HTTP header "dssession." Subsequent requests from the client must include a header "Pragma" with the session ID to the server to recognize that the request comes from the same client. This session remains active until the time expires (by default is 20 minutes).

The support code generated by the DataSnap wizard manages the session ID with a JavaScript global variable "$$$$SessionID" and passes next to each AJAX call on the same page. If you change the page or refresh it the session ID is lost.

You can, however, force the code to add this support JavaScript session ID cookie to a browser, so that is still available on all pages. If you try to call a REST URL directly in the browser, you'll be prompted to login HTTP standard. Once the user is authenticated and its session, the method is not called again.

In short, a flexible architecture is always welcome, but the authentication scheme used by Embarcadero is really useless in any real situation, do not use adequate security. You are transmitting clear text, you are transmitting the password! No matter you encrypt the session, is a basic flaw send the password itself.

Another point is unpleasant is when the credentials "username and password" are wrong, you need to restart another session, reopen the browser to be challenged for a username and password dialog box Basic authentication, this is really terrible. 

AUTHENTICATION SCHEME WITH MORMOT:

I did not understand how mORMot Authentication scheme works fully yet. The authentication process is quite secured and complex. It uses a nonce and to increase security, add a salt at the beginning of a SHA-256 hashed expression. The authentication scheme require to exchange binary data, using “params” they are encoded in strings. The connection handshaking requires more than a single call to establish the security context.

The SHA hash functions were designed by the National Security Agency (NSA). SHA-256 is one of the four variants in the SHA-2 set. It isn't as widely used as SHA-1, though it appears to provide much better security.

In mORMot, in order to create a new user session, first of all:
a) a JS Client sends a GET ModelRoot/auth?UserName=... request to the remote server;

b) Server answers with an hexadecimal nonce contents (valid for about 5 minutes);

c) Client sends a GET ModelRoot/auth?UserName=...&PassWord=...&ClientNonce=... request to the remote server, in which ClientNonce is a random value used as Client nonce, and PassWord is computed from the log-on and password entered by the User, using both Server and Client nonce as salt;

d) Server checks that the transmitted password is valid, i.e. that its matches the hashed password stored in its database and a time-valid Server nonce - if the value is not correct, authentication failed;

e) On success, Server will create a new in-memory session (sessions are not stored in the database, for lighter and safer process) and returns the session number and a private key to be used during the session;

f) On any further access to the Server, a &session_signature= parameter is added to the URL, and will be checked against the valid sessions in order to validate the request;

g) When the Client is about to close (typically in TSQLRestClientURI. Destroy), the GET ModelRoot/auth?UserName=...&Session=... request is sent to the remote server, in order to explicitly close the corresponding session in the server memory (avoiding most re-play attacks);

Looks like Embarcardero is unable to understand what security means in today's world. Please go back to drawing board and design a more modern solution - and not one of the 80's.

 

Tags: Datasnap authentication scheme; mORMot authentication; Javascript authentication;