Canvas View
The Canvas View is the application's largest and richest interface for the end user. Usually, the Canvas View is rendered within a Yahoo! landing page, surrounded by a Yahoo! header, footer, and an advertisement unit. End users access a Canvas View from a variety of locations: the Small View, links for user Updates, email links, and Web links. Unlike the Small View, the Canvas View supports third-party advertisements and promotions. The size of a Canvas View must not be fixed. Be sure to use a fluid layout so that the view will be properly displayed on different Yahoo! sites. A vertical scroll bar appears when necessary.
The application code for the Canvas View is hosted on a server outside of YAP. To specify the code's location, in the Project Details page, enter the URL in the Application URL field.
The Canvas View code can be HTML, YML, CSS, and the subset of JavaScript allowed by Caja. This code can be generated by a variety of languages, such as PHP, XML/XSLT, and Ruby on Rails.
To protect the private information of end users, YAP applies the following security mechanisms to the Canvas View:
- The Canvas View is presented within an iframe.
- HTML is sanitized to remove unsafe code.
- JavaScript is translated by Caja.
You should design the Canvas View so that it has the following two states:
- Uninstalled: The user is visiting your application but has not customized it or given it permission to access Yahoo! user data; the user's identity (GUID) is unknown to the application. In this state, the Canvas View should encourage the user to customize the application.
- Personalized: The user has installed your application, his or her identity is known, and the full functionality of the Canvas view is available.
