Using Signed Proxy Content to Generate the Initial App Rendering

Blog Post created by hsaputra on Oct 16, 2012

As part of the OpenSocial specifications, the Jive Apps framework supports a signed proxy request for initial rendering to allow Jive Apps to be pre-rendered in the server side when the Jive instance is trying to fetch the content from the origin server.


By setting the authz attribute in the Content element of the Jive Apps' app.xml file, it lets the Jive as OpenSocial container to know what authentication protocol desired for the App's proxy content fetching.


For example:

<Content type="url" href="http://www.example.com/" authz="signed" sign_owner="true" sign_viewer="false"></Content>


If authz is set to "signed", based on the OpenSocial specefications , the Jive instance will do signed fetch to the App origin server as part of content proxy requestwith additional information that could help the App server to get more context to generate HTML markup dynamically in server instead of making additional call from client browsers with JavaScript.


The additional information includes:

  1. opensocial_viewer_id - The ID of the current viewer, which matches the getId() value on the viewer person object.
  2. opensocial_owner_id - The ID of the current owner, which matches the getId() value on the owner person object.
  3. opensocial_app_url - The URL of the application making the request. Containers may alias multiple application URLs to a single canonical application URL in the case where an application changes URLs.
  4. opensocial_instance_id - An opaque identifier used to distinguish between multiple instances of the same application in a single container. If a container does not allow multiple instances of the same application to coexist, this parameter may be omitted. The combination of opensocial_app_url and opensocial_instance_id uniquely identify an instance of an application in a container.
  5. opensocial_app_id - An opaque identifier for the application, unique to a particular container. Containers that wish to maintain backwards compatibility with the opensocial-0.7 specification may include this parameter.
  6. xoauth_public_key - An opaque identifier for the public key used to sign the request. This parameter may be omitted by containers that do not use public keys to sign requests, or if the container arranges other means of key distribution with the target of the request.