<p>In the last couple of days I have been playing around with the idea of combining GitHub Actions and GitHub Pages to be able to dynamically build preview environments every time a pull request is opened against a repository hosting a client-side web app.</p><p>The idea is that you can quickly preview the changes made by some contributor, without having to clone their branch and running everything locally, something specially useful for open source projects.</p><p>In this article I will explain how to set everything up, and what are some considerations and problems you may face during the process.</p><h3>Enable github pages</h3><p>The first thing you need to do is enable your project to publish pages on some branch. I recommend creating a new branch for this, let&#x27;s say <code>preview-env</code>, and then enabling publishing on it.</p><p>In order to do that go to your repository and then <strong>Settings</strong> -&gt; <strong>Pages</strong>, look for the <strong>Source</strong> section, and you should see something like this:</p><p><img src="/assets/img/preview-envs/github-pages-before-enabling.png" alt="GitHub pages before enabling"/></p><p>Click in the dropdown and select your new branch, <code>preview-env</code>. Then click <strong>Save</strong>.</p><p><img src="/assets/img/preview-envs/github-pages-after-enabling.png" alt="GitHub pages after enabling"/></p><p>After saving you will see a message at the top of this section telling you what&#x27;s the URL in which the pages are published. It always follows the same pattern. If your organization is <code>my-org</code> and your repository is <code>my-repo</code>, the url will be <code>https://my-org.github.io/my-repo/</code>.</p><h3>Configure the workflow</h3><p>Now we need to configure a workflow that will &quot;deploy&quot; the preview environment for the branch every time a new pull request is created or updated:</p><p>Let&#x27;s imagine we have a React web app that is built with node.js. The configuration could look like this.</p><pre><pre><code class="language-yml"># .github/workflows/deploy-preview.yml
name: Deploy preview

on:
  pull_request: null

jobs:
  deploy:
    runs-on: ubuntu-20.04
    continue-on-error: true
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
      - name: Use node.js 14.15
        uses: actions/setup-node@v1
        with:
          node-version: 14.15
      - name: Generate slug
        id: generate_slug
        run: echo &quot;##[set-output name=slug;]$(echo ${GITHUB_HEAD_REF#refs/heads/} | sed -r &#x27;s/[~\^]+//g&#x27; | sed -r &#x27;s/[^a-zA-Z0-9]+/-/g&#x27; | sed -r &#x27;s/^-+\|-+$//g&#x27; | tr A-Z a-z)&quot;
      - name: Build
        run: npm ci &amp;&amp; npm run build
      - name: Deploy
        uses: JamesIves/github-pages-deploy-action@4.1.1
        with:
          branch: preview-env
          folder: build
          target-folder: ${{ steps.generate_slug.outputs.slug }}
      - name: Publish env
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          header: Preview environment
          message: |
            ## Preview environment
            https://my-org.github.io/my-repo/${{ steps.generate_slug.outputs.slug }}/
</code></pre></pre><blockquote><p>If you are not familiar with GitHub Actions yet, take a look at the <a target="_blank" rel="noopener noreferrer" href="https://docs.github.com/en/actions">official documentation</a>.</p></blockquote><p>This workflow will follow the next steps:</p><ul><li>Checkout the code from the repository.</li><li>Set-up node.js 14.15</li><li>Based on the branch name, generate a slug that we will use to have separated deployment folders for every pull request we receive. The slug is exposed to next steps as an output.</li><li>Build the project. This step will obviously depend on the needs of your project.</li><li>Using <a target="_blank" rel="noopener noreferrer" href="https://github.com/JamesIves/github-pages-deploy-action">JamesIves/github-pages-deploy-action</a>, deploy the contents we previously built in the GitHub page, under a sub-folder matching the slug we generated a few steps above, and under the branch <code>preview-env</code> (remember we enabled GitHub pages for this branch).</li><li>Finally, using <a target="_blank" rel="noopener noreferrer" href="https://github.com/marocchino/sticky-pull-request-comment">marocchino/sticky-pull-request-comment</a>, post a comment in the pull request with a link to the preview environment, so that you can just click on it and see the deployment.</li></ul><p>The steps may change depending on your needs and how you build your project. For example, I have an extra step to update a property in the <code>package.json</code> that is then used to allow serving the app in a sub-path instead of the root of the domain.</p><p>You may also not build your site with node.js, as you could be using any of the multiple existing static site generators out there, but you get the idea.</p><p>Finally, you have probably noticed the config includes <code>continue-on-error: true</code>. This will allow the pull request to be merged even if this process fails for some reason.</p><h3>Considerations when using forks</h3><p>While the configuration above will work perfectly when creating pull requests inside the same repository, there are some limitations when the pull request comes from a fork (which is the usual in OSS projects).</p><p>For security reasons, the <code>GITHUB_TOKEN</code> injected in those cases doesn&#x27;t have write permissions, which will make the &quot;deploy&quot; step fail.</p><p>Also, you cannot define your own token with more permissions and inject it as a secret, as the secrets are not exposed to workflows running on forks.</p><p>However, with a couple small config changes, we can work around these limitations:</p><h4>Change event</h4><p>The first thing we need to do is use the <code>pull_request_target</code> event instead of the <code>pull_request</code> one.</p><pre><pre><code class="language-diff">on:
-  pull_request: null
+  pull_request_target: null
</code></pre></pre><p>According to the documentation, this is equivalent to the <code>pull_request</code> event, but it runs in the scope of the base repository.</p><p>Thanks to this, the <code>GITHUB_TOKEN</code> will come with write permissions, and we will have access to secrets if needed.</p><h4>Checkout the fork</h4><p>The second thing we are going to change is that we now need to specify the repository to checkout.</p><p>In order to do that, we need to add two inputs to the &quot;Checkout code&quot; step, like this:</p><pre><pre><code class="language-diff">    steps:
      - name: Checkout code
        uses: actions/checkout@v2
+       with:
+         repository: ${{ github.event.pull_request.head.repo.full_name }}
+         ref: ${{ github.event.pull_request.head.ref }}
</code></pre></pre><p>This will ensure we checkout from the fork repository, instead of the base one, which is the default, as it&#x27;s the one where the <code>pull_request_target</code> event is scoped to.</p><p>And that&#x27;s it. With these two changes you can now deploy preview environments for pull requests coming from forks.</p><blockquote><p><strong>IMPORTANT!</strong> The limitations of the <code>pull_request</code> event are there for a reason. People could potentially get access to your secrets or manipulate your code. Proceed at your own risk.</p></blockquote><h3>Other considerations</h3><p>Other than the limitations for forks, there are a few other minor things to take into consideration.</p><ul><li>Changes in GitHub Pages do not reflect immediately. It may take up to a couple of minutes for the deployment to be available, but considering you will usually not review a PR right after it has been created, this should not be a big issue.</li><li>As you have seen, every time a pull request is created, the deployment will generate a new folder in your GitHub Pages branch. This may result in a lot of old folders to pile-up, so you may want to set up some way to clean them up periodically or after the pull request has been merged.</li><li>Due to the fact that GitHub Pages only allows static pages to be served, this process cannot be used with apps that require some kind of back-end or server-side logic.</li><li>If your project is already using GitHub Pages for something else (serve the project&#x27;s website or docs), that may conflict with this, preventing you from having this kind of preview envs.</li></ul>

Setting-up a preview environment for your client-side apps with GitHub Actions and GitHub Pages

<p>I remember many years ago, when I released my first open source project, that every time I had a new release ready, I was never sure what should be the new version number.</p><p>Versioning software is not as straightforward as it might look when you don&#x27;t have a lot of experience.</p><p>In this article I&#x27;ll try to explain the <a target="_blank" rel="noopener noreferrer" href="https://semver.org/">SemVer</a> approach to version software, and some things you might want to take into account on top of that.</p><h3>Semantic Versioning</h3><p>The first thing you need is a solid set of rules that help you decide which should your next version be.</p><p>I remember thinking <em>&quot;is this version big enough as to jump from 1.0 to 2.0?&quot;</em> or <em>&quot;I have seen projects using three numbers for the version, X.Y.Z, should I do the same?&quot;</em></p><p>Those questions are easier to answer if you stick to some standard that tells you what to do, and that will help others more easily understand your intention.</p><p>My recommendation is to use <a target="_blank" rel="noopener noreferrer" href="https://semver.org/">Semantic Versioning</a>, as it defines a solid starting point, and it&#x27;s quite adopted by the community.</p><p>Semantic Versioning states that you should use three numbers to identify versions, <code>MAJOR.MINOR.PATCH</code>, and follow these rules in order to decide which one to increase:</p><ul><li><code>PATCH</code>: the new release includes only bug fixes. People are encouraged to update to this release and no changes are needed in their code bases.</li><li><code>MINOR</code>: the new release includes new backwards-compatible features. People can update to this version without changing their code bases, and make use of the new features afterwards if they wish.</li><li><code>MAJOR</code>: the new release includes <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Backward_compatibility">backward compatibility</a> breaks. Changes in the code base will be needed when updating to this version.</li></ul><blockquote><p>These rules are easier to apply to libraries and frameworks than it is for apps and services. More about this later.</p></blockquote><h3>Try to keep backwards-compatibility</h3><p>Ok, we have some rules now. However, I have seen very frequently people mistaking what <em>can</em> be done with what <em>should</em> be done.</p><p>Yes, if you introduce a breaking change, you can update the major version and that&#x27;s it. However, if you do it too frequently, people won&#x27;t be happy, and you will end up with a fragmented user base, that stop updating to newer versions.</p><p>I remember using a library to deploy stuff that had a new major version every couple of months, changing things like &quot;The <code>host</code> function is now called <code>server</code>&quot;. Yes, ok, but why do I have to change my stuff so frequently.</p><p>It&#x27;s usually better to try to implement things in a backwards-compatible way, and keep track of the things you want to change and do it all at a time.</p><p>You can also deprecate things, and document the way you want those things to be done moving forward. That way you give people the chance to start changing their code and simplify a hypothetical upcoming major release.</p><h3>Provide clear upgrade paths</h3><p>As mentioned above, too frequent major version changes are not desirable, but sooner or later you will want to release a new major version for different reasons.</p><ul><li>Getting rid of that feature which is hard to maintain, introduces lots of bugs, and provides little value.</li><li>Supporting something new which is very hard to implement without breaking backwards compatibility.</li><li>Removing all those deprecated methods you have been dragging for months.</li><li>Fix design issues, where something was architected in the wrong way, and only spotted after some time.</li></ul><p>At the time this happens you will want your users to upgrade to the newer version, as you don&#x27;t want people to report bugs that only affect older versions, or to expect you to backport fixes to older versions because they haven&#x27;t updated to the new one.</p><p>The best way to achieve this is to provide clear and simple upgrade paths:</p><ul><li><p>Prepare your releases for the things to come: If you want to introduce new ways of doing things, do it before the major release, and deprecate the older ones. For example, you can have a new method that gets called by an older one, while you mark the old one as deprecated.</p><p>People will be more willing to update and change their code afterwards. By the time the major release is published, their code will be ready to upgrade.</p></li><li><p>Include a CHANGELOG file in your project, explaining the changes introduced in every version. A very good way to document a change log is the <a target="_blank" rel="noopener noreferrer" href="https://keepachangelog.com/">Keep a changelog</a> initiative.</p><p>You can also use some other platform to document the change log, like GitHub releases.</p></li><li><p>Include documentation on how to upgrade to a major release: This is probably the most important one. Document all the steps that need to be followed and all the required changes to update from a release to the next major one.</p><p>A good way to do this is by including an UPGRADE file in your project. You can see <a target="_blank" rel="noopener noreferrer" href="https://github.com/acmailer/acmailer/blob/main/UPGRADE.md">this example</a>.</p></li></ul><h3>Versioning libraries vs apps</h3><p>Semantic Versioning is a good standard to version software, but it plays much better with libraries and frameworks that are installed using some kind of package manager, than it does with apps and services that are not directly depended on.</p><p>For example, how do you identify a backward compatibility break on a web user interface?</p><p>With this kind of software there are more grey areas, and you will end up using your intuition.</p><p>For example, not long ago I released a <a href="/2020/12/24/released-shlink-web-client-v3-0-0/">new major version</a> for a web app I maintain, and it was completely compatible with the previous one. However, it introduced a larger amount of features than usual, and big UI changes, so I decided it was worth the bump.</p><p>Because of this there are projects that use different approaches to version apps. For example:</p><ul><li>Firefox and Chrome have 6-week cycles, and after each one of them they release a new major version no matter what.</li><li>Jetbrains publishes a few releases of their IDEs every year (I think 3) which always start with the year they were released on, like <code>2020.3.0</code>, and they increase the patch number for bugfixes.</li><li>Ubuntu releases 2 versions every year, one in April and one in October, and they are always identified by the year and month they were released on, like <code>19.04</code> or <code>20.10</code>.</li></ul><h3>Special versions</h3><p>There&#x27;s also a set of special versions that can be used to publish the so-called <strong>pre-release</strong> versions. These <a target="_blank" rel="noopener noreferrer" href="https://semver.org/#spec-item-9">are covered</a> by Semantic Versioning, but sometimes they are not so easy to understand.</p><p>It is also very likely that you never have to use these, as only relatively big projects will need this level of granularity, but it&#x27;s still good to know what&#x27;s their purpose and what do they imply.</p><h4>0.x.y</h4><p>It is possible to release a version of your software where the major number is <code>0</code>. When this happens, it means your software is still in its early stages.</p><p>It does not mean it&#x27;s necessarily unstable, but it means you are still introducing frequent changes on it, and therefore, it might be a bit more fragile than a version starting with a number greater than <code>0</code>.</p><h4>Alpha</h4><p>The intention of an alpha release is that a subset of people con test some new functionality, but you don&#x27;t want people to use it in production</p><p>Alpha versions are on their very early stages. Their public API is very likely to change, and they probably contain bugs.</p><p>Semantic Versioning states that alpha versions are identified by this pattern: <code>MAJOR.MINOR.PATCH-alpha.NUMBER</code>, for example <code>2.0.0-alpha.1</code>.</p><h4>Beta</h4><p>Similar to alpha versions, beta versions are also prone to contain bugs, but their API will in theory not change. That means that you could potentially adapt your software to start using a beta version, and when the corresponding stable release is published, you shouldn&#x27;t need that many changes.</p><p>Semantic Versioning defines a pattern similar to the one for alpha versions: <code>MAJOR.MINOR.PATCH-beta.NUMBER</code>, for example <code>2.0.0-beta.1</code>.</p><h4>Release candidate</h4><p>Release candidates (RC) are pre-release versions that you will want to publish for the general user-base to test an upcoming release. You want to publish a RC so that it&#x27;s battle tested by as many people as possible, in order to find possible bugs and edge cases.</p><p>They should not contain many bugs, but some could be found. The public API should not change anymore.</p><p>According to Semantic Versioning, the pattern to identify a RC is <code>MAJOR.MINOR.PATCH-rc.NUMBER</code>, for example <code>2.0.0-rc.1</code>.</p><h3>Conclusion</h3><p>We have seen some approaches and considerations to properly version your software.</p><p>Versioning is not so straightforward when you don&#x27;t have a lot of experience, but as you have seen, you just need to know a small set of rules and use a bit your intuition.</p><p>With those tools, you will be able to properly version your software.</p>

What to take into account when versioning software

<p>Two days ago I released the first major version in almost 2 years for <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlink-web-client</a>, a web UI for <a target="_blank" rel="noopener noreferrer" href="https://shlink.io">shlink</a>, my self-hosted URL shortener.</p><p>This new version introduces several improvements to the project, and I thought it was worth writing a post to explain all of them in depth.</p><h3>New design</h3><p>The project has been using the same design almost since the beginning. It was clean, but it laked a bit of contrast and consistency in many sections.</p><p>Now the main background is light-gray, with components composed in white cards with a slight box shadow, that makes them easier to spot inside the app.</p><p>Also, the main area has now a max-width that prevents components from stretching too much on wide screens.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/design-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/design-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Overview page</h3><p>Up until now, after connecting to a Shlink server, you went directly to the list of short URLs.</p><p>With this new version, you now see an overview page first, which displays some general stats, a quick short URL creation form, and the latest 5 short URLs.</p><p>From there, you can navigate to the full list of short URLs, with filtering capabilities, or go to the advanced short URL creation form.</p><div class="row"><div class="col-md-8 col-md-offset-2 "><img alt="Overview" src="/assets/img/shlink-web-client-3/overview.png" class="gallery-item"/><p class="text-center"><small>Overview</small></p></div></div><h3>Improved short URL creation form</h3><p>One of the sections with more room for improvement was the short URL creation form. It had all the inputs mixed, displaying just the &quot;long url&quot; one, with the option to un-collapsing the rest at will.</p><p>The new design groups the inputs by context, which makes it more clear. It also displays the inputs all the time, since the &quot;quick form&quot; is now located in the overview page.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/creation-form-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/creation-form-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Enhanced visits page</h3><p>The visits page had a problem, it was trying to display too much information in a single place.</p><ul><li>Visits over time</li><li>Visits from every platform</li><li>Visits from every location</li><li>A list of visits as a table</li></ul><p>The new approach splits those in subsections with their own sub-route each (<code>/by-location</code>, <code>/by-context</code>, etc). This helps to render a smaller amount of charts at once, since they are a bit CPU greedy.</p><p>Also, only the visits from the last 30 days are loaded by default, making it load way faster for URLs with a lot of visits.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/visits-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/visits-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Outer sections</h3><p>The app has some sections which are not related to a specific server, like creating/editing servers, or the settings page.</p><p>These sections have also been adapted to the new style, and they also have a max-width for wide screens.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/create-server-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/create-server-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Date range selector</h3><p>A new component allows selecting date ranges either by relative time ranges (last 30 days, last 90 days...) or by selecting absolute start and end dates.</p><p>This component is used to filter both short URL lists and visits lists.</p><div class="row"><div class="col-md-6  col-md-offset-3"><img alt="Date range selector" src="/assets/img/shlink-web-client-3/date-range-selector.png" class=""/><p class="text-center"><small>Date range selector</small></p></div></div><h3>Domain selector</h3><p>Shlink has had multi-domain support for some versions, but changing the domain from the web client required to set the value manually, which is a bit error-prone.</p><p>This version introduces a new component which allows selecting from domains already used in the past (which is what you will want in most of the cases), preventing accidental typos.</p><p>It also allows setting new values in case you want to use a new domain that you never used before. This domain will then appear in the list the next time.</p><div class="row"><div class="col-md-6  "><img alt="Existing domains" src="/assets/img/shlink-web-client-3/domains-existing.png" class=""/><p class="text-center"><small>Existing domains</small></p></div><div class="col-md-6  "><img alt="New domain" src="/assets/img/shlink-web-client-3/domains-new.png" class=""/><p class="text-center"><small>New domain</small></p></div></div><h3>Other improvements</h3><p>The changes described so far were the major ones. However, v3.0.0 includes a few other minor improvements.</p><ul><li>Result and loading messages have been standardized: They are now more consistent and use the same set of components, which also ensures consistency in the future.</li><li>Error messages are now more descriptive: Instead of showing generic error messages when API calls fail, the actual error message is now always displayed, so that it&#x27;s easier to know what failed.</li><li>Dropped support for Shlink v1: All major versions come with some breaking changes that improve code maintainability. This one drops Shlink v1 support, which allows removing some conditional paths here and there.</li></ul><p>Other than the last point, Shlink v3.0.0 is mostly backwards compatible, so it&#x27;s safe to upgrade if you are already using Shlink v2.x</p><h3>Next steps</h3><p>Of course this doesn&#x27;t end here, and I have a lot of ideas to improve it even further.</p><ul><li>Dark theme: It&#x27;s what the cool kids do these days, and I have already done some experiments around it.</li><li>Shlink dashboard: Next gen web app for Shlink. You can read the whole reasoning in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client/issues/338">this issue</a>.</li><li>Filtering in lists added to URL: Many sections allow filtering lists, but the state is saved in memory, which means it gets lost if the page is refreshed, and it cannot be bookmarked. The intention is to make all filtering params to become part of the URL.</li><li>Exporting visits in CSV: It&#x27;s cool to see charts full of info, but sometimes admins need to feed other services with the data, and consuming the original API is not always an option. Exporting visits to a CSV file will be supported soon by shlink-web-client.</li></ul>

Released shlink-web-client v3.0.0

<p>Let&#x27;s not deny that <a target="_blank" rel="noopener noreferrer" href="https://github.com/features/actions">GitHub actions</a> are hitting hard in the tech community, and many projects are transitioning from other continuous integration systems like <a target="_blank" rel="noopener noreferrer" href="https://circleci.com/">Circle CI</a> or <a target="_blank" rel="noopener noreferrer" href="https://travis-ci.org/">Travis CI</a>.</p><p>Personally I have been using Travis a lot during the past years, for all my OSS projects, and I have gotten very used to it.</p><p>However, people seem to be &quot;abandoning&quot; travis in favor of GitHub Actions, for different reasons. &quot;It&#x27;s faster&quot;, &quot;I can run smaller tasks in parallel&quot;, etc.</p><p>In my case, I have moved a few very specific tasks there, where travis was becoming a bottleneck, but I still have mixed feelings about the very-verbose yaml-based config needed to configure a few GitHub Actions, compared to the more concise travis one.</p><p>In this article I&#x27;ll explain how I improved a travis build to run several smaller tasks in parallel jobs, without having to completely move away from it.</p><h3>Initial state</h3><p>This project&#x27;s travis config is relatively simple. It is used to build a JS project for the web browser, and it has to run the next tasks:</p><ul><li>Lint the code, to make sure it fulfils the project&#x27;s coding standards.</li><li>Run unit tests.</li><li>Run mutation tests.</li><li>Build the docker image, to make sure none of the new changes broke it.</li><li>Conditionally publish a release on GitHub, with a dist file attached to it, if the build is being run for a git tag.</li></ul><pre><pre><code class="language-yaml">dist: bionic

language: node_js

branches:
  only:
    - /.*/

cache:
  directories:
    - node_modules

services:
  - docker

node_js:
  - &#x27;12.16.3&#x27;

install: npm ci

before_script:
  - echo &quot;Building commit range ${TRAVIS_COMMIT_RANGE}&quot;
  - export MUTATION_FILES=$(git diff ${TRAVIS_COMMIT_RANGE:-origin/main} --name-only | grep -E &#x27;src\/(.*).(ts|tsx)$&#x27; | paste -sd &quot;,&quot;)

script:
  - npm run lint
  - npm run test:ci
  - npm run mutate:ci
  - docker build -t project:test .

after_success:
  - node_modules/.bin/ocular coverage/clover.xml

before_deploy: npm run build ${TRAVIS_TAG#?}

deploy:
  - provider: releases
    api_key:
      secure: &lt;key&gt;
    file: &quot;./dist/project_${TRAVIS_TAG#?}_dist.zip&quot;
    skip_cleanup: true
    on:
      tags: true
</code></pre></pre><h3>Problems with this approach</h3><p>This is more or less ok, but the last two commands in <code>script</code> can be relatively slow and can delay the whole process.</p><p>Also, specially the mutation tests one, which is currently always considered successful regardless the result, can make the build reach the maximum run time allowed by travis, making the whole build falsely fail.</p><blockquote><p>The reason for the <code>before_script</code> step is to determine which source code files changed, and run mutation tests on them only, in order to mitigate this.</p></blockquote><p>Other than this, the build config defines &quot;global&quot; customizations that are actually only used for some tasks:</p><ul><li>Running <code>npm ci</code> is not required for the <code>docker build</code> task.</li><li>Getting the <code>docker</code> service is not required by any of the other tasks.</li><li>Determining changed files is only used by the <code>mutation tests</code> task.</li></ul><h3>Making use of jobs</h3><p>One cool feature travis supports is the use of a job <a target="_blank" rel="noopener noreferrer" href="https://docs.travis-ci.com/user/build-matrix/">build matrix</a>, that lets you define multiple jobs that run in parallel as part of the same build, and make each one of them do unrelated tasks.</p><p>Using this feature it is possible to improve the <code>.travis.yml</code> file, making it look like this:</p><pre><pre><code class="language-yaml">dist: bionic

language: node_js

branches:
  only:
    - /.*/

cache:
  directories:
    - node_modules

node_js:
  - &#x27;12.16.3&#x27;

jobs:
  fast_finish: true
  allow_failures:
    - name: &#x27;Mutation tests&#x27;
  include:

    - name: &#x27;Lint&#x27;
      install: npm ci
      script: npm run lint

    - name: &#x27;Unit tests&#x27;
      install: npm ci
      script: npm run test:ci
      after_success:
        - node_modules/.bin/ocular coverage/clover.xml

    - name: &#x27;Mutation tests&#x27;
      install: npm ci
      before_script:
        - echo &quot;Building commit range ${TRAVIS_COMMIT_RANGE}&quot;
        - export MUTATION_FILES=$(git diff ${TRAVIS_COMMIT_RANGE:-origin/main} --name-only | grep -E &#x27;src\/(.*).(ts|tsx)$&#x27; | paste -sd &quot;,&quot;)
      script: npm run mutate:ci

    - name: &#x27;Build docker image&#x27;
      services:
        - docker
      install: skip
      script: docker build -t project:test .

    - name: &#x27;Publish release&#x27;
      if: tag IS present
      install: skip
      script: skip
      before_deploy: npm run build ${TRAVIS_TAG#?}
      deploy:
        - provider: releases
          api_key:
            secure: &lt;key&gt;
          file: &quot;./dist/project_${TRAVIS_TAG#?}_dist.zip&quot;
          skip_cleanup: true
          on:
            tags: true
</code></pre></pre><p>This approach introduces all these benefits:</p><ul><li>Now linting, testing, mutation testing and building the docker image run in parallel, making the build finish earlier.</li><li>The mutation testing step is allowed to fail, and thanks to the <code>fast_finish</code> flag, travis won&#x27;t even wait for it to finish, considering the build successful once the rest have passed.</li><li>Configs that are only meaningful for certain jobs are defined in the job itself, instead of globally.</li><li>The &quot;publish release&quot; job only runs conditionally if the build is for a tag, thanks to the <code>if: tag IS present</code> condition. (More info about <a target="_blank" rel="noopener noreferrer" href="https://docs.travis-ci.com/user/conditional-builds-stages-jobs/">conditional jobs</a> in travis).</li><li>As soon as any of the jobs fails, the whole build fails and you don&#x27;t have to continue waiting. Before this, if the third task failed, you still had to wait for the previous two to finish.</li><li>Each job can have a name, making it more clear in travis UI what tasks are being run:</li></ul><p><img src="/assets/img/travis-multiple-jobs/travis-jobs.png" alt="Travis CI jobs"/></p><h3>Conclusion</h3><p>The main purpose of this article was to showcase that travis still has a lot to give. Github Actions are definitely cool, but there&#x27;s usually no silver bullet for everything, and a combination with other tools might be more suitable.</p><p>Also, this allows people using travis to improve their builds without having to change everything. Then, once you have split your tasks, if you still want to move to Github Actions, it should be easier.</p><blockquote><p>If you are curious, this is the project in which I use this travis configuration: <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlinkio/shlink-web-client</a>.</p></blockquote>

Running several steps of a Travis CI build in parallel

<p>Asynchronous and non-blocking runtimes are pretty usual in many programming languages, as well as long-lived web apps that stay in memory and are capable of dispatching multiple HTTP requests without having to be fully bootstrapped every time. This has not been traditionally the case with PHP apps. </p><p>However, many projects are starting to get some adoption, that bring this long-lived approach to the PHP world.</p><p>The problem with this is that PHP developers are not used to this, and they tend to continue acting as they have always done. Also, libraries might have made some assumptions, making them not work as expected when used under this context.</p><p>Some of these projects are <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk">swoole</a>, <a target="_blank" rel="noopener noreferrer" href="https://reactphp.org/">ReactPHP</a> or <a target="_blank" rel="noopener noreferrer" href="https://amphp.org/">Amphp</a>, to give some examples.</p><p>In this article, I will be focusing on the first one, and explain how to approach some of the pain points I have found after using it for a year and a half on an <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink">existing PHP project</a>.</p><h3>Introducing Swoole</h3><p>The main difference swoole has compared to other similar projects is that it&#x27;s written as a native PHP extension, and needs to be installed with <code>pecl</code>.</p><p>This is obviously a bit cumbersome, but the benefit is that, since it&#x27;s written in C++, it has a better handling of memory allocation, which is very important to achieve what it tries to do.</p><p>What swoole does is running a main process which bootstraps the PHP application once, and then keeps it in memory so that it can continue dispatching requests without having to load resources every time. This makes it really fast.</p><p>Those HTTP requests are handled by a set of child processes called &quot;web workers&quot;. Swoole forks the contents in memory for the main process to each one of the workers, so each worker has a &quot;copy&quot; of the application in memory.</p><p>Each worker is independent, but each one of them can only handle one request at a time, so you have to increase the number of workers if you expect a lot of concurrent traffic.</p><p>Other than web workers, swoole also has another set of child processes called &quot;task workers&quot;, which can be used to delegate long tasks at runtime to prevent web workers from getting blocked.</p><p>Here you can see a diagram of swoole&#x27;s architecture.</p><p><img src="https://www.swoole.co.uk/images/how-swoole-works.png" alt="How Swoole works"/></p><blockquote><p>More information can be found in <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/how-it-works">Swoole&#x27;s website</a>.</p></blockquote><h3>Problems to solve</h3><p>Now that we know how swoole works, let&#x27;s see some of the challanges I have faced in th past, which are usually not that ovbious when you are used to think in terms of &quot;blocking&quot; and &quot;short-lived&quot;.</p><h4>Database connections are kept open</h4><p>One of the first things you find out is that, since the application stays in memory, any database connection that has been opened by a worker (either web or task worker), will be kept open and reused in subsequent executions or HTTP requests served by the app.</p><p>This, which is in theory good, has a side effect, which is not obvious during development: <strong>the opened connection will eventually expire</strong>.</p><p>Since most of the popular database abstraction layers in PHP are coming from the times in which PHP was just a bootstrap-on-every-request technology, they never cared too much about expired database connections, as they would be opened again on next request.</p><p>However, when using swoole and the like, you have to implement some mechanism which takes care of reconnecting or gracefully recovering when this happens.</p><blockquote><p>I wrote an article explaining how I solved this on a middleware-based app served with swoole and using doctrine: <a href="/2019/11/04/how-to-properly-handle-a-doctrine-entity-manager-on-an-expressive-application-served-with-swoole/">How to properly handle a doctrine entity manager on an expressive application served with swoole</a></p></blockquote><p>Obviously, swoole (and also others) provides some tools to work with databases (like this <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/docs/modules/swoole-async-mysql-client">MySQL client</a>), which I&#x27;m sure do not have this problem (although, I haven&#x27;t personally tried this), but they are more limited than other well adopted libraries.</p><h4>In-memory caches don&#x27;t behave as expected</h4><p>It is a frequent practice to use local in-memory caches, like APCu, to improve applications performance in production.</p><p>Usually APCu is faster than other options, like redis or memcached, so it&#x27;s the choice when you only have one instance of your app running (meaning, you don&#x27;t have a cluster behind a load balancer).</p><p>However, even if you are running your app on just one server with swoole, because of the web worker system explained earlier, you actually have several copies of your app in memory, and each one of them will have a separated and not shared cache when using APCu.</p><p>This can lead to inconsistencies which are hard to debug, so you need to have it in mind.</p><p>Also, since the information that is being loaded is kept in memory anyway, you will not notice such a big improvement by using APCu or other in-memory caches.</p><blockquote><p>Notice that this problem does not happen when using distributed/centralized caching solutions, such as redis or memcached, as in that case, the caching technology is shared by all workers.</p></blockquote><h4>No need to optimize file including/requiring</h4><p>Many projects have complex configuration systems which are spread into several files. While this make it more maintainable, it also has a performance impact when all those files need to be loaded on every request.</p><p>Because of that, there are libraries like <a target="_blank" rel="noopener noreferrer" href="https://github.com/laminas/laminas-config-aggregator">laminas-config-aggregator</a> that can dynamically load config from many sources and, if some conditions are met, they can merge the result in a single bigger file that can be used in later requests.</p><p>In the case of swoole, as all the files will be kept in memory once loaded for the first time, there&#x27;s no need for this kind of optimization.</p><h4>Class autoloading happens once</h4><p>This point is very related with the previous one.</p><p>Composer offers a lot of optimization options so that class autoloading is faster in production. While you usually will still want to use some of those so that the first time a class is being loaded it is still reasonably fast, any subsequent hits will just use the class which is already in memory.</p><p>One of the composer flags you will probably don&#x27;t want use with swoole is <code>--apcu-autoloader</code>, because of the reasons mentioned two points above this one.</p><h4>Services should be truly stateless</h4><p>This is something that you should always do anyway, but it&#x27;s specially important when a service instance is kept in memory between HTTP requests.</p><p>Sometimes it&#x27;s easy to end up having some small piece of internal state on a service, where we save something as a side effect of a method call, to end up using it when another one of the public methods is invoked.</p><p>While this could seem harmless when the whole app is bootstrapped on every request, it can have very dangerous side effects when the app is served with swoole, because the instance will persist until another request is dispatched by the same web worker.</p><p>Just imagine you saved some user data on a service, and it ends up being served to another user on the next request. That won&#x27;t look good.</p><p>Because of this, make sure your services are truly stateless, and if for any reason that&#x27;s not possible, at least remember to have some mechanism in place that flushes the data just before finishing the request.</p><h4>Hot reloading for dev envs is not that good</h4><p>One thing we usually take for granted is that we can modify a PHP file and just by making a new request, the new code will be executed. However, when the code is kept in memory, it&#x27;s not that straightforward.</p><p>When you are developing a project which is served with swoole, you will have to restart the server every time to get your changes applied.</p><p>Swoole has a mechanism to do a light server reload, which is faster. You can find the docs in <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/docs/modules/swoole-server-reload">it&#x27;s website</a>.</p><p>The problem with this is that you need to implement the mechanism to invoke that when a file is changed, or use some library that does it for you.</p><p>Also, I have noticed that even calling that and seeing that the server is reloaded, does not always have the expected effect, and you have to still end up doing a hard reload. It&#x27;s something I don&#x27;t fully understand and I still need to investigate a bit further.</p><h3>Conclusion</h3><p>As it always happens when new technologies appear, it takes some time to get used to them, but I strongly suggest you to give a try to swoole or any other non-blocking runtime, because it makes your apps super fast.</p><p>Just remember to have all of the above in mind ;-)</p><p>That said, here you can find some libraries that will make your life easier when trying to serve existing projects with swoole, without having to couple with it and being able to continue using your favourite framework:</p><ul><li>IDE helper: <a target="_blank" rel="noopener noreferrer" href="https://github.com/swoft-cloud/swoole-ide-helper">https://github.com/swoft-cloud/swoole-ide-helper</a></li><li>Mezzio (formerly Zend Expressive): <a target="_blank" rel="noopener noreferrer" href="https://github.com/mezzio/mezzio-swoole">https://github.com/mezzio/mezzio-swoole</a></li><li>Symfony: <a target="_blank" rel="noopener noreferrer" href="https://github.com/k911/swoole-bundle">https://github.com/k911/swoole-bundle</a></li><li>Laravel: <a target="_blank" rel="noopener noreferrer" href="https://github.com/swooletw/laravel-swoole">https://github.com/swooletw/laravel-swoole</a></li></ul><p>Also, here you can find some more articles talking about this topic:</p><ul><li><a target="_blank" rel="noopener noreferrer" href="https://www.zend.com/blog/why-you-should-use-asynchronous-php">https://www.zend.com/blog/why-you-should-use-asynchronous-php</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://samsonasik.wordpress.com/2020/04/05/using-swoole-in-mezzio-application-with-sdebug/">https://samsonasik.wordpress.com/2020/04/05/using-swoole-in-mezzio-application-with-sdebug/</a></li></ul>

Considerations when working with async PHP runtimes like swoole

<div class="well well-sm"><b>This article was first published in <a target="_blank" rel="noopener noreferrer" href="https://devzone.zend.com/7245/project-scalability-with-zend-expressive/">Zend Developer Zone</a></b></div><p>I&#x27;ve been working with some different frameworks lately. One of them is <a target="_blank" rel="noopener noreferrer" href="https://docs.zendframework.com/zend-expressive/">Zend Expressive</a>, and I&#x27;ve come to the conclusion that I don&#x27;t need to choose between different frameworks; depending on the project, Expressive always fits my needs and scales from small projects to bigger applications.</p><h3>The Microframework approach</h3><p>The first thing that one could see on the <a target="_blank" rel="noopener noreferrer" href="https://docs.zendframework.com/zend-expressive/getting-started/standalone/">&quot;Hello world&quot; example</a> is that Expressive seems like a typical microframework: you create an application object and register routes with it.</p><p>Something like this:</p><pre><pre><code class="language-php">use zend\Expressive\AppFactory;

include __DIR__ . &#x27;/../vendor/autoload.php&#x27;;

$app = AppFactory::create();

$app-&gt;get(&#x27;/greet/{name}&#x27;, function ($request, $response, callable $out = null) {
    $response-&gt;getBody()-&gt;write(sprintf(&#x27;Hello %s!!&#x27;, $request-&gt;getAttribute(&#x27;name&#x27;)));
    return $response;
});
$app-&gt;(&#x27;/about&#x27;, function ($request, $response, callable $out = null) {
    ob_start();
    include &#x27;templates/about.html&#x27;;
    $response-&gt;getBody()-&gt;write(ob_get_clean());
    return $response;
});

$app-&gt;pipeRoutingMiddleware();
$app-&gt;pipeDispatchMiddleware();
$app-&gt;run();
</code></pre></pre><p>This is a super simple example, which I feel is the best approach for prototyping and small applications. You can write an entire app in hours.</p><p>This is the so called &quot;programmatic approach&quot;, and you can read more about it <a target="_blank" rel="noopener noreferrer" href="https://mwop.net/blog/2016-05-16-programmatic-expressive.html">here</a>. This same approach is used by other microframeworks.</p><p>However, if your application grows, this could be hard to maintain.</p><ul><li>What if your application has 100 different routes instead of 2?</li><li>What if you need to render dynamic templates?</li><li>What if you need to use complex services while dispatching your routes? They will need to be created somewhere.</li></ul><p>In the past, you had to take this into account. A microframework was good for small projects (websites, blogs, and such), but for bigger projects, one would choose frameworks like Symfony, Laravel or Zend Framework with the MVC stack. This is no longer necessary with Zend Expressive.</p><p>Zend Expressive allows the previously described approach, but also other approaches reminiscent of these bigger frameworks. Some of the features that make Zend Expressive my framework of choice for any kind of project are:</p><ul><li>Decoupled from specific implementations for dependency injection, templating, or routing</li><li>Supports a configuration-driven approach.</li><li>Supports complex dependency injection by using advanced dependency injection containers like zend-servicemanager.</li><li>Supports modular applications, easing code reuse.</li><li>It is based on middleware.</li><li>It is not hard to implement a mvc-like system with controllers.</li></ul><h3>Choosing implementations</h3><p>The first thing that makes Expressive different from other frameworks is that it doesn&#x27;t come with its own implementation for everything. It doesn&#x27;t try to reinvent the wheel; instead, it relies on interfaces. You can use the component of your choice for routing, templating, and dependency injection. You could also implement your own if you prefer.</p><p>For example, by default, Expressive supports three routers: FastRoute, Aura router, and zend-router. In my website I needed a router with support for optional parameters at the beginning of the route, and none of them supports it.</p><p>My solution was integrating <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya/expressive-slim-router">Slim 2 router</a>, which allows that.</p><p>Something similar is possible while choosing the template renderer. Expressive comes with built-in support for Twig, Plates, and zend-view, but you can use whichever renderer you like. It wouldn&#x27;t be hard to integrate Laravel&#x27;s Blade, for example.</p><p>For dependency injection, Zend Expressive supports any container implementing <code>Interop\Container\ContainerInterface</code>, so there are plenty of options to choose from.</p><h3>Configuration-driven applications</h3><p>One of the best things about Zend Expressive is that you can move all the configuration to dynamic configuration files, including:</p><ul><li>Definition of routes</li><li>Definition of middlewares to pipe</li><li>Definition of template renderer, router, and container implementations</li><li>Definition of configuration consumed by other services</li></ul><p>This approach also allows to define environment-specific configuration, and override production configurations with local configurations, like disabling cache or having a more verbose error handler (which is not desired in production but will help during development).</p><p>In order to achieve this, instead of creating the application with the static factory (<code>Zend\Expressive\AppFactory</code>), you have to use the container factory (<code>Zend\Expressive\Container\ApplicationFactory</code>).</p><p>It is intended to be used with a dependency injection container, and a more complex process is used while creating the application.</p><p>It fetches the configuration of the application itself from a <code>config</code> service, which should contain an array (or ArrayObject) with keys like <code>routes</code> or <code>middleware-pipeline</code>.</p><p>For example, if we want to register the same routes defined in the first example via configuration, we need to define something like this.</p><pre><pre><code class="language-php">return [

    &#x27;routes&#x27; =&gt; [
        [
            &#x27;name&#x27; =&gt; &#x27;greet&#x27;,
            &#x27;path&#x27; =&gt; &#x27;/greet/{name}&#x27;,
            &#x27;middleware&#x27; =&gt; function ($request, $response, callable $out = null) {
                $response-&gt;getBody()-&gt;write(sprintf(&#x27;Hello %s!!&#x27;, $request-&gt;getAttribute(&#x27;name&#x27;)));
                return $response;
            },
            &#x27;allowed_methods&#x27; =&gt; [&#x27;GET&#x27;],
        ],
        [
            &#x27;name&#x27; =&gt; &#x27;about&#x27;,
            &#x27;path&#x27; =&gt; &#x27;/about&#x27;,
            &#x27;middleware&#x27; =&gt; function ($request, $response, callable $out = null) {
                ob_start();
                include &#x27;templates/about.html&#x27;;
                $response-&gt;getBody()-&gt;write(ob_get_clean());
                return $response;
            },
            &#x27;allowed_methods&#x27; =&gt; [&#x27;GET&#x27;],
        ],
    ],

];
</code></pre></pre><blockquote><p>I have used middleware closures to demonstrate that any middleware used in the programmatic approach is valid here, but you should avoid it while working with the configuration-driven approach, since it will break the configuration caching process.</p></blockquote><p>With this, the <code>ApplicationFactory</code> preregisters all the routes before returning the <code>Application</code> instance.</p><p>The same happens with non-routable middleware (we&#x27;ll talk about middleware later), and other configurations.</p><p>With this approach, the first thing we need to do is create the dependency injection container, which will be responsible of creating the application object. Something like this:</p><pre><pre><code class="language-php">use Interop\Container\ContainerInterface;
use Zend\Expressive\Application;

/** @var ContainerInterface $container */
$container = include __DIR__ . &#x27;/../config/container.php&#x27;;
/** @var Application $app */
$app = $container-&gt;get(Application::class);
$app-&gt;run();
</code></pre></pre><blockquote><p>Note that Expressive projects can be easily created from scratch by using the <a target="_blank" rel="noopener noreferrer" href="https://docs.zendframework.com/zend-expressive/getting-started/skeleton/">skeleton installer</a>, which in the process will ask you for the concrete implementations to use and initialize all the code above, including base configuration files.</p></blockquote><p>While the configuration-driven approach would be my choice, it is also possible to take a hybrid approach between the programmatic and the config-driven options.</p><p>You can use the container factory so that the environment-specific configuration system is applied, and dependencies and service-specific configs are properly loaded, but still define routes programmatically.</p><pre><pre><code class="language-php">use Interop\Container\ContainerInterface;
use Zend\Expressive\Application;

/** @var ContainerInterface $container */
$container = include __DIR__ . &#x27;/../config/container.php&#x27;;
/** @var Application $app */
$app = $container-&gt;get(Application::class);

// After getting the application from the container, it is still possible to define routes
$app-&gt;get(&#x27;/home&#x27;, ...);
$app-&gt;post(&#x27;/contact&#x27;, ...);

$app-&gt;run();
</code></pre></pre><h3>Complex dependency injection</h3><p>We have already seen that Zend Expressive allows you to use the implementation of your choice for dependency injection.</p><p>In a medium project you can use a simple DI container, like pimple or aura DI. However, in a bigger project you will probably need a more advanced container, like php-di or zend-servicemanager. Expressive allows you to use any container that implements <code>Interop\Container\ContainerInterface</code>.</p><p>If none is defined, the static <code>AppFactory</code> uses zend-servicemanager, and the <code>ApplicationFactory</code> injects into the application the same container that was used to invoke it.</p><p>Other microframeworks assume that you are working on a small project, and you are a little bit limited by their DI implementation. Expressive gives you the freedom to use the implementation that best suits your needs.</p><h3>Modular applications</h3><p>For big projects, modularity is very important.</p><p>You can wrap classes, configuration, language files, templates, tests, etc, in a self-contained package that can be installed in other projects.</p><p>Other frameworks like Zend Framework and Symfony provide great solutions for this (modules and bundles), and it is easy to do this with Expressive too, while you can still work in a single-module way if the project doesn&#x27;t need more complexity.</p><p>In order to add modularity to an Expressive project, you can use the <a target="_blank" rel="noopener noreferrer" href="https://github.com/mtymek/expressive-config-manager">mtymek/expressive-config-manager</a> package. It includes a simple class that is able to merge the configuration from many sources (while working with the configuration-driven approach), so that the application is created by being aware of all of those modules, and thus, get preconfigured services or override other configurations.</p><p>You just need to define the configuration of every module and an invokable class that provides the configuration itself.</p><p>Indeed, that package can be used in any project, not just Expressive-based projects, but it was built with Zend Expressive in mind.</p><h3>The middleware paradigm</h3><p>New microframeworks are working with the middleware paradigm. Expressive is one of them.</p><p>Middleware is a great way of defining pieces of code that are easy to test and reuse in other middleware-based projects.</p><p>If you need to learn more about middleware, <a target="_blank" rel="noopener noreferrer" href="https://mwop.net/blog/2015-01-08-on-http-middleware-and-psr-7.html">this is a great article</a> to read now.</p><p>Expressive uses middleware not only before dispatching a route, but also for the route itself, so, in the end, everything is middleware.</p><p>Also, unlike other microframeworks where you need to provide callables every time you need a middleware, Expressive supports passing service names, which makes it use the DI container in order to get the middleware instance. This improves performance and eases dependency injection.</p><p>This approach can be used both in the programmatic and config-driven approaches.</p><pre><pre><code class="language-php">use Zend\ServiceManager\ServiceManager;

$sm = new ServiceManager([
    &#x27;invokables&#x27; =&gt; [
         \MyMiddleware::class =&gt; MyMiddleware::class,
    ],
]);

$app = AppFactory::create($sm);
$app-&gt;get(&#x27;/home&#x27;, \MyMiddleware::class);

// [...]
</code></pre></pre><p>When this app is run and the &quot;/home&quot; route is dispatched, the middleware used to dispatch the request will be lazily fetched from the DI container and invoked.</p><p>This same thing could be done with the config-driven approach like this.</p><pre><pre><code class="language-php">use Zend\Expressive\Application;
use Zend\ServiceManager\ServiceManager;

$sm = new ServiceManager([
    &#x27;services&#x27; =&gt; [
        &#x27;config&#x27; =&gt; [
            &#x27;routes&#x27; =&gt; [
                [
                    &#x27;name&#x27; =&gt; &#x27;home&#x27;,
                    &#x27;middleware&#x27; =&gt; \MyMiddleware::class,
                    &#x27;path&#x27; =&gt; &#x27;/home&#x27;,
                    &#x27;allowed_methods&#x27; =&gt; [&#x27;GET&#x27;],
                ],
            ],
        ],
    ],
    &#x27;invokables&#x27; =&gt; [
         \MyMiddleware::class =&gt; MyMiddleware::class,
    ],
    &#x27;factories&#x27; =&gt; [
        Application::class =&gt; Zend\Expressive\Container\ApplicationFactory::class,
    ],
]);

$app = $sm-&gt;get(Application::class);

// [...]
</code></pre></pre><h3>Controller-style dispatch</h3><p>The last thing we need so that Expressive is as similar as possible to bigger frameworks, is being able to dispatch similar requests with the same controller class, allowing us to share dependencies and not having to repeat the same creation process for different middlewares.</p><p>This is also possible by using <a target="_blank" rel="noopener noreferrer" href="https://twitter.com/samsonasik">Abdul</a>&#x27;s implementation, which is now part of the official <a target="_blank" rel="noopener noreferrer" href="https://docs.zendframework.com/zend-expressive/cookbook/using-routed-middleware-class-as-controller/">Expressive cookbook</a>.</p><p>This approach is similar to that used in traditional full-stack MVC controllers.</p><p>You can also easily define rest controllers as <a href="/2016/06/24/dispatch-rest-like-requests-with-a-single-controller-class-in-zend-expressive/">I explained in my blog</a> not so long ago.</p><p>However, this should be primarily used if you want to migrate an existing application to Zend Expressive. For new projects it&#x27;s better to have a single middleware to handle each route. That approach improves granularity, and makes middlewares easier to test.</p><p>The redundancy problem that is produced by this approach can be easily mitigated by reusing the same factory for all the middlewares.</p><h3>Conclusion</h3><p>In this article, I&#x27;ve attempted to demonstrate an undocumented feature of Zend Expressive: <strong>project scalability</strong>.</p><p>The project offers a low learning curve, allowing you to immediately start writing smaller projects, but provides a path for creating larger, maintainable applications.</p>

Project Scalability with Zend Expressive

<p>I was digging into Zend Expressive and how to use controllers that allow me to share dependencies between different routes, instead of having to use different middlewares every time.</p><p><a target="_blank" rel="noopener noreferrer" href="https://samsonasik.wordpress.com/">Abdul</a> wrote a great article on this subject that you can find <a target="_blank" rel="noopener noreferrer" href="https://samsonasik.wordpress.com/2016/01/03/using-routed-middleware-class-as-controller-with-multi-actions-in-expressive/">here</a>, which also became part of <a target="_blank" rel="noopener noreferrer" href="https://zendframework.github.io/zend-expressive/cookbook/using-routed-middleware-class-as-controller/">Expressive&#x27;s cookbook</a> some time later.</p><p>This is a perfect approach that easily allows to reuse some code, but then I thought how to do something similar in a rest environment, having a single class with different dispatchable methods that will be called depending on the request&#x27;s HTTP method.</p><p>This is a possible solution based on ZF2&#x27;s <a target="_blank" rel="noopener noreferrer" href="https://github.com/zendframework/zend-mvc/blob/master/src/Controller/AbstractRestfulController.php">AbstractRestfulController</a></p><h3>The abstract implementation</h3><p>We need some default behavior and some code that can be reused, so this could be our <code>AbstractRestController</code>.</p><pre><pre><code class="language-php">namespace App\Rest;

use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;
use Zend\Diactoros\Response\JsonResponse;
use Zend\Stratigility\MiddlewareInterface;

abstract class AbstractRestController implements MiddlewareInterface
{
    const IDENTIFIER_NAME = &#x27;id&#x27;;

    /**
     * @param Request $request
     * @param Response $response
     * @param null|callable $out
     * @return null|Response
     */
    public function __invoke(Request $request, Response $response, callable $out = null)
    {
        $requestMethod = strtoupper($request-&gt;getMethod());
        $id = $request-&gt;getAttribute(static::IDENTIFIER_NAME);

        switch ($requestMethod) {
            case &#x27;GET&#x27;:
                return isset($id)
                    ? $this-&gt;get($request, $response, $out)
                    : $this-&gt;getList($request, $response, $out);
            case &#x27;POST&#x27;:
                return $this-&gt;create($request, $response, $out);
            case &#x27;PUT&#x27;:
                return $this-&gt;update($request, $response, $out);
            case &#x27;DELETE&#x27;:
                return isset($id)
                    ? $this-&gt;delete($request, $response, $out)
                    : $this-&gt;deleteList($request, $response, $out);
            case &#x27;HEAD&#x27;:
                return $this-&gt;head($request, $response, $out);
            case &#x27;OPTIONS&#x27;:
                return $this-&gt;options($request, $response, $out);
            case &#x27;PATCH&#x27;:
                return $this-&gt;patch($request, $response, $out);
            default:
                return $out($request, $response);
        }
    }

    public function get(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function getList(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function create(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function update(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function delete(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function deleteList(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function head(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function options(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    public function patch(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([&#x27;content&#x27; =&gt; &#x27;Method not allowed&#x27;], 405);
    }

    final protected function createResponse($data, $status = 200)
    {
        return new JsonResponse($data, $status);
    }
}
</code></pre></pre><p>It creates an invokable class that dispatches different methods based on the request HTTP method, passing the <code>$request</code>, <code>$response</code> and next middleware to all of them.</p><p>By default, it makes all the methods return a <strong>405</strong> status, so that we can leave them unimplemented in concrete controllers and any consumer knows that they are not allowed.</p><p>This class will be the base for any rest controller.</p><h3>Concrete implementations</h3><p>Once we have the abstract controller, we can define any class extending it.</p><pre><pre><code class="language-php">namespace App\Controller;

use App\Rest\AbstractRestController;
use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;

class RestUserController extends AbstractRestController
{
    public function get(Request $request, Response $response, callable $out = null)
    {
        $id = $request-&gt;getAttribute(self::IDENTIFIER_NAME);
        return $this-&gt;createResponse([
            &#x27;id&#x27; =&gt; $id,
            &#x27;name&#x27; =&gt; &#x27;John Doe&#x27;,
        ]);
    }

    public function getList(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([
            [
                &#x27;id&#x27; =&gt; &#x27;e2f7ee10-af32-46e7-86cc-5afe441b69e5&#x27;,
                &#x27;name&#x27; =&gt; &#x27;John Doe&#x27;,
            ],
            [
                &#x27;id&#x27; =&gt; &#x27;04162d88-dd7c-4855-ae4f-cc63e64edd7c&#x27;,
                &#x27;name&#x27; =&gt; &#x27;Jane Doe&#x27;,
            ],
        ]);
    }

    public function create(Request $request, Response $response, callable $out = null)
    {
        return $this-&gt;createResponse([
            &#x27;message&#x27; =&gt; &#x27;You have created a new user&#x27;,
        ]);
    }

    public function delete(Request $request, Response $response, callable $out = null)
    {
        $id = $request-&gt;getAttribute(self::IDENTIFIER_NAME);
        return $this-&gt;createResponse([
            &#x27;message&#x27; =&gt; sprintf(&#x27;You have deleted the user with id %s&#x27;, $id),
        ]);
    }
}
</code></pre></pre><p>This class overrides only 4 of the public methods, returning custom responses.</p><p>We will usually inject some service on this controller and use it to perform CRUD operations. In this example I have just hardcoded the responses. </p><h3>Register the route</h3><p>Once the controller is created, we need to register a route setting this controller as the middleware and allowing any method, since the HTTP method check will be performed in the controller itself.</p><p>If you have created your app starting from the <a target="_blank" rel="noopener noreferrer" href="https://github.com/zendframework/zend-expressive-skeleton">skeleton application</a>, you just need to open the <code>config/autoload/routes.global.php</code> file and add the route and register your controller as a service.</p><p>The registration of the controller will depend on the container implementation and how it needs to be created. In this case I&#x27;m using the Zned\ServiceManager component, and the controller is a simple invokable service without dependencies.</p><p>Also, the route definition could slightly change depending on the chosen router. I&#x27;m using FastRoute.</p><pre><pre><code class="language-php">use App\Action\RestUserController;
use Zend\ServiceManager\Factory\InvokableFactory;

return [
    &#x27;dependencies&#x27; =&gt; [
        &#x27;factories&#x27; =&gt; [
            RestUserController::class =&gt; InvokableFactory::class,
        ],
    ],

    &#x27;routes&#x27; =&gt; [
        // [...]

        [
            &#x27;name&#x27; =&gt; &#x27;rest.client&#x27;,
            &#x27;path&#x27; =&gt; &#x27;/rest/user[/{id}]&#x27;,
            &#x27;middleware&#x27; =&gt; RestUserController::class,
        ],
    ],
];
</code></pre></pre><p>When the <code>allowed_methods</code> key is not set, it allows any method by default.</p><p>Now, a GET request to the <strong>/rest/user</strong> route will return the list of users, a DELETE request to <strong>/rest/user/123</strong> will delete the user 123 and so one.</p>

Dispatch REST-like requests with a single controller class in Zend Expressive

<p>Performance is an important subject when a project grows.</p><p>There are some good practices that make projects more maintainable, like <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Dependency_injection">dependency injection</a>, however, creating all the objects at the beginning of the request could reduce the application performance.</p><p>If some of the created objects are not finally used, we have wasted CPU time and memory for no reason.</p><h3>DI pattern basics</h3><p>The dependency injection pattern is &quot;simple&quot;. It is one way to implement the <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Dependency_inversion_principle">Dependency Inversion Principle</a>, and it says that all the objects that certain subject depends on should be injected on it when the subject is created, rather than letting the subject internally create them at runtime.</p><p>This decouples every part of the application and eases testing each subject.</p><p>However, what happens if some of those objects are not finally used?</p><h3>The proxy pattern to the rescue</h3><p>A proxy is a lightweight wrapper for an expensive object. It implements the same type of the wrapped object, but delays the object creation until it is going to be really used, for example by overriding all the public methods and initializing the wrapped object the first time one of them is called.</p><p>If we used proxies for every expensive dependency, the previous problem would be solved. We can still inject the dependency, but it will be wrapped by the proxy, which will create the object itself once we need it, or never, if it is not finally used.</p><p>This is the principle behind lazy services. The ServiceManager makes use of the <a target="_blank" rel="noopener noreferrer" href="https://github.com/Ocramius/ProxyManager">ocramius/proxy-manager</a> package to create proxies on the fly for all the services configured as lazy.</p><h3>Lazy services config</h3><p>The <code>lazy_services</code> config block used to be an independent block on v2 of the ServiceManager. On v3 it has been integrated on the ServiceManager configuration itself, along with <code>factories</code>, <code>invokables</code> and such.</p><p>This is an example of <code>lazy_services</code> usage:</p><pre><pre><code class="language-php">use Acelaya\Database\DbConnFactory;
use Acelaya\Service\MyExpensiveService;
use Acelaya\Service\MyExpensiveServiceFactory;
use Zend\ServiceManager\Proxy\LazyServiceFactory;
use Zend\ServiceManager\ServiceManager;

$sm = new ServiceManager([
    &#x27;factories&#x27; =&gt; [
        &#x27;db_connection&#x27; =&gt; DbConnFactory::class,
        MyExpensiveService::class =&gt; MyExpensiveServiceFactory::class,
    ],

    &#x27;lazy_services&#x27; =&gt; [
        &#x27;class_map&#x27; =&gt; [
            &#x27;db_connection&#x27; =&gt; \PDO::class,
            MyExpensiveService::class =&gt; MyExpensiveService::class,
        ],
        &#x27;proxies_target_dir&#x27; =&gt; &#x27;data/proxies&#x27;,
        &#x27;proxies_namespace&#x27; =&gt; &#x27;AcelayaProxy&#x27;,
        &#x27;write_proxy_files&#x27; =&gt; getenv(&#x27;APPLICATION_ENV&#x27;) === &#x27;prod&#x27;,
    ],

    &#x27;delegators&#x27; =&gt; [
        &#x27;db_connection&#x27; =&gt; [
            LazyServiceFactory::class,
        ],
        MyExpensiveService::class =&gt; [
            LazyServiceFactory::class,
        ],
    ],
]);
</code></pre></pre><p><strong>But how does this work?</strong></p><p>The first thing we have to do is register our services the regular way. In this case I have registered 2 services in the <code>factories</code> block, the <code>db_connection</code>and the <code>MyExpensiveService</code>. I can fetch those services in a normal way, and their factories will be hit in order to create them.</p><p>But we don&#x27;t want that. We want a proxy to be returned, wrapping the factory that will be hit only when the object is going to be used.</p><p>The next block, <code>lazy_services</code>, wraps some config params, like the <code>class_map</code>, which determines the class that needs to be proxied for each service (sometimes the service name is the class itself, but we still have to map it).</p><p>Finally, by making use of the <code>delegators</code> block, we have to add a built-in delegator to each lazy service, the <code>Zend\ServiceManager\Proxy\LazyServiceFactory</code>.</p><p><strong>Important!</strong>: If your service needs more delegators, this one should be the last one of the list, so that it is the first one hit.</p><p>This delegator is the one which makes the magic. Instead of calling the next delegator until the factory is hit, it returns the generated proxy, and makes it wrap the next factory, so that the delegators chain which ends on the main factory, is only hit the first time the object is going to be used.</p><p>The rest of the <code>lazy_services</code> properties are only used for convenience.</p><ul><li>The <code>proxies_target_dir</code> tells where proxies should be created. If you don&#x27;t define it, the system temp dir will be used.</li><li>The <code>proxies_namespace</code> tells the namespace to be used for proxy classes.</li><li>The <code>write_proxy_files</code> property is a boolean which tells whether to persist generated proxies or generate them every time. It is a good idea that you set it to false on development, so that proxies are regenerated every time, in case the proxied classes have changed, and true on production to improve performance, so that once a proxy has been created, the same file is used every time.</li></ul><h3>How to fetch lazy services</h3><p>The good thing is that the whole process is transparent. You don&#x27;t need to change your code.</p><p>If you were already fetching services and you want to make them lazy, you just need to map them and add the <code>LazyServiceFactory</code> delegator in the ServiceManager config. Everything else remains the same.</p>

Using ServiceManager 3 lazy services to improve your PHP application performance

<p>Everyone who regularly visits my blog knows that I&#x27;m an absolute fan of the <a target="_blank" rel="noopener noreferrer" href="https://zendframework.github.io/zend-servicemanager/">Zend\ServiceManager</a> component.</p><p>It is always my choice to deal with dependency injection in any kind of project, more now that v3 has been released, which is faster and has a better public API.</p><p>The workflow while working with the <code>ServiceManager</code> is usually the same. You create a factory or abstract factory that creates a service and then you register that service into the <code>ServiceManager</code> itself.</p><p>Of course you have to optimize your code, and you should try to reuse the same factories whenever possible, and try not to abuse of abstract factories and initializers.</p><h3>Detecting a problem</h3><p>The thing is that if your project grows, you will end with lots of services, and probably lots of factories too.</p><p>There are services that are complicated to create, like the <code>Application</code> object in many frameworks, or services like doctrine&#x27;s <code>EntityManager</code>. They need to check a lot of configuration elements, and not only get some dependencies injected.</p><p>The factory pattern is perfect for these kind of services, but there are a lot of services too where you end up creating a factory just to fetch a couple services from the <code>ServiceManager</code> and injecting them in the new service constructor.</p><p>This could be an example:</p><pre><pre><code class="language-php">namespace Acelaya\Factory;

use Acelaya\Foo;
use Acelaya\MyService;
use Interop\Container\ContainerInterface;
use Zend\ServiceManager\Factory\FactoryInterface;

class MyFactory
{
    public function __invoke(ContainerInterface $container, $requestedName, array $options = null)
    {
        $foo = $container-&gt;get(Foo::class);
        $bar = $container-&gt;get(&#x27;bar&#x27;);
        
        return new MyService($foo, $bar);
    }
}
</code></pre></pre><p>In my applications, these kind of services are very usually more than a half of the total registered services, and at the end it is boring and repetitive, and you have to maintain a lot of classes that don&#x27;t really do much.</p><h3>Proposing a solution</h3><p>So I decided to find a solution that would allow me not to repeat the same task over and over.</p><p>After some research and trying some different solutions I ended up creating the <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya/zsm-annotated-services">acelaya/zsm-annotated-services</a> package, which allows you to annotate your service constructors and use a common factory which is already provided. It supports both v2 and v3 of the ServiceManager.</p><p>By making use of the <code>$requestedName</code> argument that all ServiceManager factories receive (even in v2, although it is not in the FactoryInterface), and assuming that the service name is the fully qualified class name, that factory reads a special <code>@Inject</code> annotation in the service constructor, which contains the name of the services that need to be injected.</p><p>This way, the service in the previos example could be defined like this:</p><pre><pre><code class="language-php">namespace Acelaya;

use Acelaya\ZsmAnnotatedServices\Annotation\Inject;

class MyService
{
    /**
     * @Inject({Foo::class, &quot;bar&quot;})
     */
    public function __construct(Foo $foo, $bar)
    {
        // [...]
    }
}
</code></pre></pre><p>The <code>@Inject</code> annotation receives an array of service names in the same order that they need to be injected in the constructor. Then the provided <code>AnnotatedFactory</code> reads that list and fetches them from the <code>ServiceManager</code>, and finally creates the service and injects the dependencies in the same order. You just need to register the service like this:</p><pre><pre><code class="language-php">use Acelaya\MyService;
use Acelaya\ZsmAnnotatedServices\Factory\V3\AnnotatedFactory;
use Zend\ServiceManager\ServiceManager;

return new ServiceManager([
    &#x27;factories&#x27; =&gt; [
        MyService::class =&gt; AnnotatedFactory::class,
    ],
]);
</code></pre></pre><p>This is perfect, because we don&#x27;t need to create a new factory for every service. We can always use the provided factory to register many services.</p><p>That allows us not to have to maintain so many classes, so many tests and also it means that a lot less includes are going to be done by the autoloader.</p><p>Also, using factories instead of abstract factories is faster at runtime.</p><h3>Considerations</h3><p>There are, however, a couple of things to have in mind while using this package.</p><p>Processing the annotations on every request is very slow. That&#x27;s why this package allows you to provide a <a target="_blank" rel="noopener noreferrer" href="https://github.com/doctrine/cache">doctrine/cache</a> adapter where the result of processing the annotations is saved. If you use an in-memory cache adapter (like <code>ApcuAdapter</code>), this package has almost no performance penalty.</p><p>In order to register a cache adapter, you just need to register a service with the <strong>Acelaya\ZsmAnnotatedServices\Cache</strong> key that returns a <code>Doctrine\Common\Cache\Cache</code> instance. The key is provided as a <code>CACHE_SERVICE</code> constant in the <code>AnnotatedFactory</code> class, so the previos example could be improved like this:</p><pre><pre><code class="language-php">use Acelaya\MyService;
use Acelaya\ZsmAnnotatedServices\Factory\V3\AnnotatedFactory;
use Doctrine\Common\Cache\ApcuCache;
use Doctrine\Common\Cache\ArrayCache;
use Zend\ServiceManager\ServiceManager;

return new ServiceManager([
    &#x27;factories&#x27; =&gt; [
        MyService::class =&gt; AnnotatedFactory::class,
        AnnotatedFactory::CACHE_SERVICE =&gt; function () {
            return getenv(&#x27;APP_ENV&#x27;) === &#x27;production&#x27; ? new ApcuCache() : new ArrayCache();
        }
    ],
]);
</code></pre></pre><p>It is a good idea to provide a non-persistent cache for development environments.</p><p>Also, the package has currently some limitations. Some of them will probably get fixed in the future, as new versions are released.</p><ul><li>It is not possible to perform setter or property injection, just constructor injection. Since setter injection is not a good practice, I&#x27;m not sure if this is going to change.</li><li>It is not possible to inject something that is not registered in the container. All the dependencies need to be services themselves.</li><li><del>If a service returns an array, you cannot pick just a key from it, but I will probably support this in future versions.</del><br/>**Update 2016-04-10.** As of v0.2, it is already possible to fetch just one part of an array by using dot notation. For example, **config.mail.smtp**</li><li>The <code>AnnotatedFactory</code> cannot create services that are not identified by their fully qualified class names.</li></ul><p>Anyway, if there is a service complex enough that you can&#x27;t create with annotations, you can always use regular factories.</p><h3>Performance improvements</h3><p><strong>Update 2016-05-15</strong></p><p>Since I published this article, we have started to use this library in one of my company&#x27;s biggest projects, and this is the result.</p><p>At the beginning, I started benchmarking the library by checking how much time was used to create thousands of services with or without it, and the result was that it was a very little bit slower with the <code>AnnotatedFactory</code>.</p><p>However, when a project grows, maintainability is also important, not only performance. Also, my benchmarks were made against a non-shared service, but always the same one, which was being created by the same factory.</p><p>My surprise was that after performing an important refactoring which allowed us to replace more than 150 factories by the same <code>AnnotatedFactory</code>, performance was improved by about a 20% (while using cache, of course).</p><p>I suppose this is due to the fact that the same factory instance is used to create many objects, which reduces the number of autoloader hits, the number of factories instantiated and the number of files included per request.</p>

Improving Zend\ServiceManager workflow with annotations

<p>I&#x27;m sure you are familiar with those &quot;remember me&quot; checkboxes in login forms. They are a common way to allow a user to keep his/her session in a web application for an extended period of time when he is in a trusted computer.</p><p>One could think that it is a small and easy-to-implement feature, but it has indeed a lot of considerations.</p><p>I wasn&#x27;t able to properly implement it in the first projects I worked in, and I&#x27;m trying to explain everything I&#x27;ve learned about it in the last years.</p><blockquote><p>In this article I&#x27;m not going to show you how to implement a persistent login in one or another programming language, but what are the good practices that should be followed when you implement it in the way you want.</p></blockquote><h3>First thoughts.</h3><p>The first thing that one could try is to extend the lifetime of the system that persists the session and identifies the user between requests (usually a cookie). </p><p>The problem is that many systems doesn&#x27;t allow to do that in an isolated way, you are forced to extend the lifetime of all sessions. Also, it is not always easy to change the session lifetime dynamically.</p><p>So it&#x27;s not a good idea, because the user could be accessing your app from a public computer, and his session could be stolen if he forgets to logout. </p><p>Because of this, the best way to do it is to have another element (another cookie) that keeps the persistent session and is used to transparently regenerate the regular session when it expires.</p><h3>How to implement it.</h3><p>When a user logs in and he has checked the &quot;remember me&quot; field, you will create a cookie with an extended lifetime (for example, 2 weeks).</p><p>That cookie will contain a unique token that will identify a user. It should be backed in the database by creating a table that relates the token with a user. It could contain other metadata too, like the client&#x27;s IP address or a flag that says if the session is still valid.</p><p>In consecutive requests, your system will keep checking if an authenticated user exists, but if not, instead of redirecting to a login or returning a 403 status, it should check for the persistent login cookie first.</p><p>When that cookie exists, you will find the user it belongs to, and authenticate him. Then, you will invalidate the cookie and the session in the database, and generate a new one that will expire in the same date as the previous one. Finally, the new token should be returned in a new persistent login cookie that will replace the previous one by having the same name.</p><p>When the user manually logs out, the persistent login cookie should be dropped too.</p><h3>Security considerations</h3><p>Now you have a basic idea on how to implement it, but there are some security considerations to take into account in order to avoid problems in the future.</p><p>The first thing that we have to assume is that persistent sessions have their risks. There is no way to implement a completely secure persistent login, but following this instructions the system will be reasonably secure.</p><ul><li>Persistent login will be handled by a cookie in the client and a database in the server (or a similar persistence system).</li><li>Persistent sessions will have an expiration time, for example 2 weeks. During that time, any regular session will be regenerated by the persistent session. Once it has passed, the user will be prompted to provide his credentials when the regular session expires. The expiration time will be set both in the cookie and in the database.</li><li>Persistent login cookies will contain one-time tokens. Once a token has been used it will be invalidated and a new one will be generated.</li><li>In order to protect these tokens from <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Cross-site_scripting">XSS</a> attacks in the site, persistent login cookies should be <code>HttpOnly</code>, so that they cannot be read from the browser.</li><li>Multiple valid persistent sessions will be allowed.</li><li>When a user logs out, its current persistent session in the database and the persistent login cookie will be invalidated.</li><li>The user should be able to invalidate all the persistent sessions that are still valid.</li><li>Invalid persistent sessions won&#x27;t be deleted. This way, if the user tries to access with an invalid cookie, he will be notified of a possible stolen cookie, and immediately all the other persistent sessions will be invalidated.</li><li>When the user changes his/her password, all the persistent sessions should be invalidated.</li><li>The token needs to be unique. Just generate some hash including the date and some other field. It doesn&#x27;t need to be super secure, but make sure to not send critical information to the client (like usernames or passwords).</li><li>And finally, there should be some operations restricted to users whose regular session has been regenerated by a persistent session, like changing a password or performing some kind of payment. In those cases, the user should be prompted for his current password anyway.</li></ul><p>Of course, if your system manages critical data, you shouldn&#x27;t implement persistent login at all. I don&#x27;t think you have seen it at any bank application.</p><p>In any other case, this should be a good way to go.</p>

Alejandro Celaya | Blog

Software development, agile methodologies and open source projects.

Project Scalability with Zend Expressive

Dispatch REST-like requests with a single controller class in Zend Expressive

Using ServiceManager 3 lazy services to improve your PHP application performance

Improving Zend\ServiceManager workflow with annotations

How to properly implement persistent login