Spending this, spending a week or two with the Elevator, is actually serving someone. However, I want to spend some time fixing some errors and misconceptions.
- For security, I don’t think it’s working with a wireframe.
You are dead. Safety is the basis of work. It is very important that security is performed by default rather than relying on each developer to understand every security vulnerability and make sure that every line of code takes this into account.
All we need to do is look at what happened to GitHub to understand that even the best encoders using well-known technologies can make a critical mistake.
The lift provides a reliable protective layer on top, so by default there is no XSS, CSRF, etc. but a developer can dig as deep as he wants an HTTP request and deal with bytes on a wire.
- Stateless / stateless: it’s hard to tell where the main differences are. I only know that the game also has a state if you use web sockets.
In the elevator it is very clear where you need a fortune and where not. The elevator can support stand-alone, partly in terms of state and fully functional applications. On page by page and request by request, the Lift application can be stateless or stateless (for example, in Foursquare , placement pages are stateless for search engines, but stateful for browsers that are logged in.) For for more information on design decisions around the state, see Lifting, state, and scaling .
The elevator uses Maven, sbt, Buildr, and even Ant. The lift is independent of the build conditions and the deployment environment (Java EE container, Netty, whatever). This is important because it facilitates integration with the rest of the environment.
- Upgrade with authorization, but I think there is a play2 scala plugin that does the same
Lifting has existed for more than 5 years and has many modules and things for it. The Lift web framework (unlike modules) does not depend on strength, authentication, etc., Therefore, you can use anything with an elevator.
- Async - Play 2 uses Akka. I don’t know what the elevator is using, but they also have something similar.
The lift has been supporting Async for over 5 years. He baked in the frame. The rise of Comet support is the best of any web frameworks , because, among other things, it multiplexes all "push" requests on a page with one request to the server, which avoids the hunger of the connection. How Lift makes the asynchronous process less important because one of the main philosophies with Lift is that we remove plumbing from the developer so that the developer can focus on business logic.
But for those who care, Lift has the best and lightest weight actors of any framework in Scala -land. We were the first to break away from the scala Actor library and work to pave the way for the different Actor libraries that allowed Akka and ScalaZ Actors to flourish.
- Raise ships with CSRF support. Play2 has a module for CSRF, but this adds a template to your code.
This is part of the elevator's commitment to safety. He is important .
- Authentication without authentication seems to have some security vulnerabilities. Both frameworks have stateful authentication. (play2 stateful / stateeless, lift stateful)
Lifting applications can be either state-preserved or stateless without your request. It is your choice and the elevator gives a very clear idea of how to make a decision.
In addition, as I indicated in the Lift, Status, and Scaling columns, how to serialize the state in a safe, scalable, executive way (because almost every request on the Internet an application that recognizes specific users is a state) must be made in a predictable, secure way for a platform with reasonable redefinition for developers.
Separation Note
The game is very similar to Rails: quickly get a site knocked down together, and it is based on MVC, so many developers understand this. But playing lacks the depth and breadth of Rails (community, plugins, experience, talent, etc.) If you want fast, easy MVC, then go with Rails and JRuby and write back end in scala (they work together unusually well.)
Ascent is another beast. There is a significant debugging curve there (stop thinking MVC and think about user experiences that flow into business logic first.) But as soon as you go up the decoupling curve, Lift sites are more secure, highly scalable, super-interactive and much easier to maintain over time. time.