In this model, the code for your Canvas view is a Web application that is hosted by and runs on your servers. You can write the code in the language of your choice, such as Python, Java, or PHP. To make it easier to perform authorization and access the YSP APIs, YAP provides the Social API PHP SDK. At runtime, the YAP engine proxies requests to your server, adding the additional information listed in Parameters Passed to an Open Application. The Canvas view of your application can access this additional information programmatically. For example, a Canvas view coded in PHP can access the user's GUID from the $_REQUEST superglobal. YAP saves the Small view code in a cache. To specify the default Small view code, you enter the HTML and YML statements on the Application Definition tab of the Application Editor. To personalize the Small view to each user, your application can call the setSmallView method of the PHP SDK.

YAP takes several measures to protect the user's private data. When the application accesses data through the Yahoo! Social Platform (YSP) API, OAuth verifies that the access is authorized. The YAP engine sanitizes the HTML and processes the JavaScript with Caja before sending the content back to the browser.

Figure 1.1. Server-Side

Most OpenSocial applications are written in JavaScript, which runs on the browser. When a Canvas view makes an OpenSocial io.dataRequest, the YAP engine retrieves the data by calling the corresponding YSP API. For a io.makeRequest, the YAP engine fetches content from a third-party site, sanitizes the HTML, and then sends the content back to the browser.

Figure 1.2. Browser-Side JavaScript

With the ActionScript 3 Social APIs, you can create Flash modules in a Canvas view. The Flash module has access to the viewer's session information and can obtain social information by making calls to the YSP APIs. To include a Flash Module in the Canvas view, insert a Yahoo! Markup Language (YML) tag such as the following:

Figure 1.3. Browser-Side Flash