PHP sessions and the Pragma:no-cache header

You may have seen the Pragma:no-cache response header on various website (if you're that kind of guy actually reading HTTP response headers...).

What you may not know is that this Header doesn't actually exists. The Pragma header is supposed to be *Request *header, not a *Response *header.

It is not only useless, it may also trigger strange caching bugs in IE6. I'm sure you know what kind of IE6 quirks I'm talking about. The best is to remove it, just to be sure.

This is a common misconception (I myself didn't know that before reading this excellent caching tutorial), and that header is still returned in a lot of request.

For example, if you set your session.cache_limiter to nocachein your php.ini, then PHP will send this header (as defined in the sessioncachelimiter doc. This is obviously wrong.

It also adds a weird Expires: Thu, 19 Nov 1981 08:52:00 GMT header. I don't like it as it allow easy fingerprinting of the server-side technology used.

I changed my session.cache_delimiter value to private_no_expire to return better headers.

First, it removed the useless Pragma, but it also removes the Expiresheader (Cache-Control is enough).

Working on Wednesday #1

Starting June 15th, I'll stop working at my day job for one day a week. Instead, I'll use this time to work on personal projects.

After more than 3 years of freelancing, I've been working full time for a very nice young company (making a great social game) for the past 6 months. Today, with the public release of the game, I find myself missing freelance.

I liked being able to sleep when too tired, working late at night when really productive, reading a log of blog posts on various subjects, learning new cool stuff other did. I kinda miss that on my new job.

Sure our project is damn cool and I really like working on it. I learn a lot, in fields that I was interested in but never had the chance to explore (server administration, CDN configuration, memcache, large number of users, etc).

But on the other hand, I'm almost only doing server-side work. I relatively interesting part of Javascript (nothing fancy) and a really small part of CSS.

And I miss all that front-end part of the job. I also get kind of tired of using cakePHP. I do like it a lot, but the more I write PHP and read posts about Ruby, the more I want to switch.

Working 4 days a week

I finally made a deal with my boss, for not working on Wednesday. I want to use that time to relax and learn all those things.

The last time I was working full time for a company, I finally quit because I thought I was waaaaaaay late behind all the current tech trends. It took me a couple of month to learn the cool stuff I'm armed with today : jQuery and cakePHP.

This time, I want to re-learn a whole new world, a better one. Using all I learnt those past years to make a fresh start.

What I want to learn

There's a lot of things I would love to learn, unordered :

• vim : I want to be able to write code on any machine, easily, and fast
• ruby / rails : I want to learn Ruby to be able to fully understand Rails. I have a pretty strong knowledge of cakePHP so I guess Rails won't be too hard for me.
• git : I like Mercurial, but git seems to be the de-facto VCS for all the social geeks and rails coder, so why not ?
• sass and haml : Those seems awesome, and were part of the things that make me want to try ruby. Writing CSS and HTML in a non-painful way. I already want to write modules (or are they called gems?) to enhance them, adding webperf optimisations on the fly (creating sprites/dataURI, optimizing selectors, etc).
• CoffeeScript, Kafeeine or equivalent : Following the logic behind sass, I want to be able to write Javascript easily. I always encounter issues when my jQuery code became too big, everything gets tangled together. Backbone.js seems interesting too. I'll have to test all those solution.
• nodejs : Because it looks kinda fun. I haven't really understand how it works yet, but it looks fun anyway :)
• TDD : This is not a technology, but a way of writing code that I want to learn. I tried it in cakePHP, but I spent so much time writing tests (and making them work), to finally change the implementation and broke the tests that I finally gave up. I still have to understand HOW to do it properly. I thought I read somewhere that this principle was directly intergrated into Ruby (or was it Rails ?) development.

To summarize, I want to learn the good tools that will let me focus on the project(s) I want to make, not fighting to use tools to bend them to my needs. Writing "uncompiled" css, html or Javascript and having some automation tool to automatically transform it in the most usable version to use only.

Also, I have already written a pretty decent cakePHP CMS, with a full featured admin panel that I used when making website for clients. I wanted to put it open source for all to enjoy but never really knew how to do it. I don't yet know if I want to create a whole new CMS in Rails, or if I'll do custom dev for each project, or use (and enhancing) existing CMS.

That's all for now

I might have forgotten stuff (I'd want to try couchDB/mongoDB, getting better at using Linux everyday), but here is a dump of all the things I want to achieve in the next 6 month, one day per week. I'll try to post a summary of what I learned each Wednesday, hoping that it would help others (I know I'll surely enjoy looking back at it later).

Missing bits of the official Facebook documentation

As a complement to my post about FB.ui undocumented hard limit, here are some other parts that should be in the documentation.

Custom html tag

You have to add xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraphprotocol.org/schema/" to your main <html> element.

If you don't, the <fb:like> (and possibly other <fb:*> elements) won't work in IE. I guess those unorthodox tags won't be interpreted by IE until you define the correct xmlns.

Adding a #fb-root

You also have to add a <div id="fb-root"></div> in your html code. I guess the Javascript API use it for some stuff, but I don't really know why.

The Javascript SDK logs an error message asking for this missing element if you don't have it.

Whitelisting keys of an array

I needed to validate an array create from POSTed data. I wanted to discard all keys from this array that I didn't want.

Actually, I wanted to whitelist the array, and only keep keys that were on my whitelist.

Here is the litte snippet that does it :

<?php
/**
*    Keep only specified keys of the specified array. This is useful to whitelist an array of parameters.
*    \param    $array        Original array
*    \param    $whitelist        Array of keys to keep.
**/
function array_whitelist($array, $whitelist = array()) {
  return array_intersect_key($array, array_flip($whitelist));
}
?>

Hard limits using FB.ui to post Requests

I hate Facebook documentation. All pages seems out of date, displaying wrong function signature, obsolete parameters, documentation link pointing to 404 pages, etc, etc.

I've lost some hours debugging those calls, finding whatever hard limit Facebook forced on some of the arguments.

Let us write a very basic example code :

FB.ui({
  'method' : 'apprequests',
  'display': 'iframe',
  'message' : "Hey, this Request is awesome, just accept it, ok ?",
  'title' : "Awesome request incoming",
  'filters' : [
    { "name" : "Some friends", "user_ids" : [ "97841578", "548673131", "[...]"]},
    { "name" : "Some other friends", "user_ids" : [ "97841578", "56867134", "[...]"]},
  ]
});

This should open a Request popup with the custom title and message, as well as provide a list of friends that you can filter based on two criterias : "Some friends" and "Some other friends".

What will go wrong

First, you have to know that both the message and title have a character limit. If you go over it, the popup will simply display something like "An error occurred, blah blah blah".

After some fiddling, I discovered that the limit is 50 chars for the title and 255 for the message.

Also, there is no limit (as far as I know) to the limit of custom filters you can set. See update below. But there is one to the max number of users you can define in a filter. And that number is 1000.

This means that if my user_ids list for any of my custom filters contains more than 1000 users, the popup will fail. However, you can have as many filters with 999 users as you want.

Took me a little while to find, and I thought that this could be shared.

Update

I found a new hard limit : You can't set more than 5 filters at a time. If you add one more, the Request popup will fail.

New Update

Also, if you define a callback, don't forget to return true. Otherwise Webkit will refuse to close the FB popup and you'll have to click twice for it to really close itself.

Update (bis repetita)

This one was pretty hard to find but if your filter contains a facebook id of someone that is not a friend of the currently loggued user, the filter will display nothing.

In our app, we have a filter of "Neighbors" (as most social games do). But one of thoses neighbors removed the user from its friends, and we didn't update the neighbor list to reflect that, resulting in our "Neighbors" filter being empty.