Dynamic Flash

I find it shocking that the Flash Player still lacks the ability to properly interact with RESTful web services. I keep running into this issue, and every time I scour the Internet hoping that someone, somewhere has found a solution. Every time I return disappointed, hating the Flash Player just a little bit more.

REST stands for REpresentational State Transfer, and describes a technique to organise a web service into resources that can be uniquely identified by a URI. The actions that can be performed on that resource map directly to the standard HTTP methods: GET, POST, PUT, DELETE, HEAD and OPTIONS. With properly organised resources it’s possible to do virtually everything you can do with an RPC-style web service with REST. The benefit of REST is that it goes with the grain of the web, not against it.

The problem with the Flash Player is that the URLRequest class, which is the basis for all HTTP requests, only supports GET and POST operations¹. This is due to a limitation in the NPAPI pseudo-standard used by non-IE browsers that only exposes the ability to make GET and POST requests. Unless NPAPI is updated to allow other HTTP methods, and browser vendors and plugin authors update their implementations to match that new API, we need to find other ways of interacting with RESTful web services.

Now, If you’re lucky, the web service you’re trying to interact with will support some way of overriding the request method, such as a X-HTTP-Method-Override header. If this is the case, you can use the requestHeaders property of your URLRequest object to set the appropriate method:

// Create request object with appropriate resource URL
var req:URLRequest = new URLRequest( 'http://rest.example.com/v1/book/1234' );
 
// Use POST because DELETE is non-idempotent
req.method = URLRequestMethod.POST;
 
// Specify DELETE method in X-HTTP-Method-Override header
req.requestHeaders = [ new URLRequestHeader( 'X-HTTP-Method-Override', 'DELETE') ];

If your web service isn’t quite so forgiving, the only option you have is to use the ExternalInferface class and some JavaScript magic to make requests on behalf of your Flash project and send the response back. It’s an ugly hack, but a developer’s gotta do what a developer’s gotta do. If you’re interested in this workaround, leave a comment and I’ll knock up a simple example.

For what it’s worth, Silverlight fares no better in this regard. This is not surprising since Microsoft are stuck with the same browser plug-in APIs as Adobe, but that doesn’t make it any less annoying for developers on both sides of the fence.

One of the features that I’m most looking forward to in Flash Player 10 (codenamed Astro) is local file access. Once the pipe dream of web application developers the world over, the next version of the Flash Player will allow you to read from and write to local files using a simple ActionScript interface.

This is all implemented with a few simple additions to the FileReference class. Reading the content of a file is accomplished with the FileReference.open() method, which can be called once the user has selected a file using the browse dialog. Like most things in the Flash world file loading happens asynchronously, so you’ll have to listen out for the Event.OPEN event. Once the file has loaded, the file content is available as a ByteArray object through the FileReference.data property to do with as you please.

package com.dynamicflash.examples {


public class LocalFileAccessExample {

public function LocalFileAccessExample():void {
  var fileRef = new FileReference();
  fileRef.addEventListener( Event.SELECT, onFileSelect );
  fileRef.addEventListener( Event.OPEN, onFileOpen );
  fileRef.browse();
}

private function onFileSelect( event:Event ):void {
  var fileRef:FileReference = event.target as FileReference;
  fileRef.open();
}

private function onFileOpen( event:Event ):void {
  var fileRef:FileReference = event.target as FileReference;
  var data:ByteArray = fileRef.data as ByteArray;
}


}
}

Saving data to a local file is as simple as calling the new FileReference.save() method and passing the data you want written to the file and the filename as parameters. As data you can pass either a String or a ByteArray object.

fileRef:FileReference = new FileReference();
fileRef.save( 'Here is some text', 'some.txt');

In order to make sure that nefarious Internet denizens can’t mess with a user’s files without a their knowledge, the Flash Player pops up a native operating system save dialog every time you try to write data to a file.

Consequently the filename you pass to FileReference.save() is little more than a suggestion to the user, and the default directory for the saved file seems to be the last save directory, rather than the directory the file was loaded from. I think this is a decent trade-off between functionality and security, even if it means that saving data to local files requires a little more effort on the user’s part than with traditional desktop applications.

Note: There is currently a bug in the latest beta of Flash Player 10 where any attempt to overwrite an existing file will result in that file being truncated to zero bytes, rather than being filled with the data you specified. This is a known issue, and you can track the bug over at Adobe’s issue tracker.

To illustrate this new feature, I’ve knocked up a simple application (including source code) that I’m somewhat unimaginatively calling FlexPad for you to play around with.

If you want to build your own projects that make use any of the new features in Flash Player 10, you’ll need to grab a recent stable copy of the Flex SDK. See Targeting Flash Player 10 Beta with Flex SDK 3.0.x for more information.

I’ve been meaning to sit down and this article on SproutCore ever since it shot to fame as the underlying client-side framework used to build Apple’s recently released MobileMe web application. You see, SproutCore seems to have had a falling out with web standards and web development best practices, something that wasn’t getting picked up in all the mainstream coverage it was receiving.

For the uninitiated, SproutCore is a JavaScript framework developed by SproutIt. It was initially developed to enable them to build their Mailroom application, which according to their website is a hosted help desk service for consumer-oriented businesses . So far, so good. The description given on the SproutCore website makes it sound like the framework is similar to other JavaScript libraries like YUI and JQuery, only a little more focussed on the application as a whole:

SproutCore is a framework for building applications in JavaScript with remarkably little amounts of code. It can help you build full “thick” client applications in the web browser that can create and modify data, often completely independent of your web server, communicating with your server via Ajax only when they need to save or load data.

What the above paragraph only hints at, though, is that SproutCore doesn’t just ignore progressive enhancement — it hacks it into tiny little pieces, urinates all over them and then mails them back to you one by one:

After lots of testing, we have found that the most efficient way to server a SproutCore application is as a … static web page! Once a SproutCore application is loaded into your web browser, it communicates with your backend server using Ajax.

Can you guess what an application looks like with JavaScript disabled? If you said “a blank page”, you can give yourself half a gold star. The unfortunate truth is that what you get is even worse than a blank page – you get a page devoid of any content but with UI controls that do absolutely bugger all. Don’t just take my word for it; check out the check out the SproutCore Photos example and then turn JavaScript off and hit refresh.

I thought we’d moved past this whole progressive enhancement issue back when Jeremy Keith was banging on about it to anyone who stood still for long enough. Alas, it seems there are still some poor unfortunately souls who have yet to benefit from Jeremy’s wisdom.

The total disregard for progressive enhancement is not the only thing wrong with SproutCore. Almost every UI widget and container in the framework is represented by nested <div> elements, differentiated only by their combination of class names. Where semantic elements are used they are used incorrectly (i.e. using <label> for headings). There is no sign of tab-enabling them or WAI-ARIA support, and all of this means that SproutCore applications are likely to be totally inaccessible out of the box.

OK, so SproutCore is bad, but what does all this have to do with Flash? That’s a fair question, given that the main focus of this blog has been Flash / Flex / AIR for the past 3 years. The answer is that the About SproutCore page takes a fundamentally misinformed swipe at Flash, and I’m calling them on it:

Why should I use SproutCore instead of a plugin like Flash or Silverlight?

Nobody likes using software running in a sandbox and no one likes to download plugins before they can use your software. If you want to create an application on the web that is fast, fluid, and native, and usable by everyone, use the only technologies that come built right into every browser: HTML and JavaScript. SproutCore makes it easy to do just that.

It seems that the SproutCore developers may have forgotten that JavaScript also runs in a sandbox, and it’s a great deal more restrictive than the Flash Player. Just try making a cross domain request using JavaScript, or setting up a permanent connection to a socket server, or (as is available in Flash Player 10) run-time access to local files.

They also seem to have missed the fact that the percentage of users unable to see Flash content is significantly lower than those fumbling around the Internet without JavaScript disabled. According to Adobe’s statistics content published for Flash Player 9 is viewable by an average of 97.4% of web users across all markets. That compares very favourably with the 95% of users who have JavaScript enabled according to w3schools.

Oh, and there’s nothing special about SproutCore’s fast, fluid and native controls – they are no more or less fast, fluid or native than Flash or Flex components. You can make either one look like native operating system controls but that doesn’t mean you should, and speed of execution and layout is down the to the implementation. On the speed front, it’s interesting to note that Mozilla are busy integrating Tamarin (the ActionScript virtual machine built into the Flash Player) into Firefox in order to support ECMAScript Edition 4 and speed up JavaScript execution.

The worst thing about all this for me is that this is the framework that Apple have chosen as the foundation of their MobileMe web application. There are lots and lots of bad frameworks on the Internet, but to see one used in such a prominent application by a company normally very meticulous about application design and user experience is disappointing.

I hope that the SproutCore developers read this article and take on board at least some of the points above. There’s nothing in the framework that cannot be fixed, though fixing the whole progressive enhancement issue is going to require a shifting of the framework’s focus away from 100% client-side application logic.

Aral has finally taken the wraps off of his super-secret Singularity project:

Singularity is the first large-scale online web conference in the world. Singularity is over 100 of the world’s top web visionaries, developers, designers, thought leaders, and celebrities. Singularity is three days of talks over multiple tracks. In 2008, Singularity will define Web ‘08.

I’m proud to say that I’ve signed up as a speaker for the event. My session, however, is an absolute secret that I will not divulge to anyone before the time is right. Okay, okay… I’m not 100% sure what my session is going to be just yet, but I’ve got until mid-october to sort something out. My experience working at Yahoo! – trying to bring together the best from the Flash/Flex work with the best from the HTML/CSS/JS standards world – is sure to give me a unique view on something, right?

If there’s something specific you want to hear about, let me know via the comments.

At work we’re working on an application that makes heavy use of the FileReference.upload() method to upload files to the server. We recently had a change request to add some custom HTTP headers to the upload request, which I didn’t think would be a problem. I was wrong.

When using the FileReference.upload() method to upload a file to a server, you can specify additional variables to be sent along with that upload request by means of a URLRequest object like so:

// Create new request object and point it at the right URL
var request:URLRequest = new URLRequest();
request.url = "/upload.php";
 
// Specify additional variables to be sent with request as POST data
request.method = URLRequestMethod.POST;
request.data = new URLVariables();
request.data.foo = "bar";
 
// Upload file using data from request object
fileRef.upload(request);

Since you can send custom headers using the URLRequest object’s requestHeaders property, I should have been able to specify custom headers for my file upload request fairly easily:

// Create new request object and point it at the right URL
var request:URLRequest = new URLRequest();
request.url = "/upload.php";
 
// Specify additional variables to be sent with request as POST data
request.method = URLRequestMethod.POST;
request.data = new URLVariables();
request.data.foo = "bar";
 
// Specify additional headers to be sent with request
var header:URLRequestHeader = new URLRequestHeader('X-Test-Header', 'Hello');
request.requestHeaders.push(header);
 
// Upload file using data from request object
fileRef.upload(request);

Sadly, the above code doesn’t work. I checked the raw request and response using Charles and the custom X-Test-Header I was trying to send just wasn’t coming through. I tried a number of different variations of the same code, all with the same result.

The problem, I have just discovered, is that there are a number of restrictions placed on the URLRequest object when used in conjunction with the FileReference methods. One of these restrictions is that the requestHeaders property is completely ignored when using the FileReference.upload() method, so it’s impossible to send custom HTTP headers along with a file upload.

To be completely fair to Adobe, this and the other restrictions are stated quite clearly in the documentation for the URLRequest object:

The FileReference.upload() and FileReference.download() methods do not support the URLRequest.requestHeaders parameter.

Since I can’t see any security or technical reason why the URLRequest object should be restricted in this way, I’m off to file a bug with Adobe to see if we can get this addressed in a future version of the Flash Player.

Lesson learned: RTFM.