In this model, the code for your Canvas View is a Web application that is hosted by and runs on your servers. You can write the code in the language of your choice, such as Python, Java, or PHP. To make it easier to perform authorization and access Yahoo! social data, several Yahoo! Social API SDKs are available. At runtime, the YAP engine proxies requests to your server, adding the additional information listed in Parameters Passed to an Open Application. The Canvas View of your application can access this additional information programmatically. For example, a Canvas View coded in PHP can access the user's GUID from the $_REQUEST superglobal. YAP saves the Small View code in a cache. To specify the default Small View code, you enter HTML and YML statements on the Project Details page. To personalize the Small View to each user, your application can call the setSmallView method of the Yahoo! Social SDK for PHP.

YAP takes several measures to protect the user's private data. When the application accesses data through the Yahoo! Social API, OAuth verifies that the access is authorized. The YAP engine sanitizes the HTML and processes the JavaScript with Caja before sending the content back to the browser.

Figure 1.1. Server-Side

Most OpenSocial applications are written in JavaScript, which runs on the browser. When a Canvas View makes an OpenSocial io.dataRequest, the YAP engine retrieves the data by calling the corresponding Yahoo! Social API. For a io.makeRequest, the YAP engine fetches content from a third-party site, sanitizes the HTML, and then sends the content back to the browser.

Figure 1.2. Browser-Side JavaScript

With the ActionScript 3 Social APIs, you can create Flash modules in a Canvas View. The Flash module has access to the viewer's session information and can obtain social information by making calls to the Yahoo! Social API. To include a Flash Module in the Canvas View, insert a Yahoo! Markup Language (YML) tag such as the following:

Figure 1.3. Browser-Side Flash