Feature request - ability to get image list for public gallery without logging in

jfriend

I'm doing a Smugmug customization that needs a list of images in a public gallery as fast as possible. That's all I'm fetching is just this one list of images. Every ms I spend on API calls is time the viewer is left looking at a blank screen.

I'm finding that the serialized, extra server roundtrip to login anonymously is pretty much a complete waste of time for what I'm doing. Since there's no actual state involved in anything I'm doing (just "smugmug.images.get"), it seems possible to execute it without a login first and it would perform better. So, I'm requesting that we can execute a variation of this API call (that would take the apiKey instead of a session) without first logging in so we can fetch a list of images from a gallery in one single API call rather than two.

FYI, there are forms of /rpc/gallery.mg that can get a list of images in a single ajax call, but I'd rather use the documented API and am bummed that it's slower.

devbobo

G'day John,

We had already been kinda considering this for the next APi version...making APIKey a required parameter for all methods and making SessionID an optional parameter. We can't do away with anonymous sessions altogether as there are some scenarios that require it.

But it will be less cumbersome for those that don't require those scenarios.

Cheers,

David

jfriend

devbobo wrote: »

G'day John,

We had already been kinda considering this for the next APi version...making APIKey a required parameter for all methods and making SessionID an optional parameter. We can't do away with anonymous sessions altogether as there are some scenarios that require it.

But it will be less cumbersome for those that don't require those scenarios.

Cheers,

David

So, lo and behold before I see your response here, I'm working on my error handling and looking at the possible error return codes from images.get and I see invalid API key as one possible return value. That seems weird. This method doesn't take an APIKey. Hmmm, could it be that images.get already lets you specify an API key instead of a session? It isn't documented that way, but I try it and it works. I can just give an APIKey parameter to images.get instead of a session and get my image list in one call instead of two. Am I OK doing this on json/1.2.2? It seems to work.

Edit: Strangely, this worked for a couple days (no login, just using smugmug.images.get with an APIKey instead of a session) and then it stopped working. So, I'm back to doing the double calls (login anonymously, then images.get).

Anyway, it sure would be nice if login wasn't required when not needed. It would cut my roundtrips to the smugmug server in half and speed up my page load time.

jfriend

So, I have this code that does a login anonymously and then smugmug.images.get.

When the site was in read-only mode due to some problem (just now), the login anonymously failed with error 99 (read-only mode). That's a real bummer. All I want to do is the smugmug.images.get. Is there a way to do that from scratch when the site is in read-only mode?

I see that the Shizam slideshow appears to be doing a smugmug.images.get with APIKey and not doing a login anonymously first. Can someone please gives us the real story on what is and isn't allowed with this? Can I skip the login and go directly to a smugmug.images.get with APIKey and no session? When I try it, it works for awhile, then it starts returning error 3: invalid session. That forces me back to using login first, which is both slower and doesn't succeed when the site is in read-only mode.

The endpoint I'm using is http://api.smugmug.com/services/api/json/1.2.2/ or, if done from a user's own customization on their own site, the endpoint is http://nickname.smugmug.com/services/api/json/1.2.2/ because of cross site scripting restrictions.

devbobo

Your observations regarding shiz's slideshow aren't entirely correct. For any method call that requires the SessionID if the SessionID isn't sent, the session cookie is loaded instead.

So Sam calls smugmug.images.get, if that fails he calls smugmug.login.anonymously, then recalls smugmug.images.get.

As I previously state, the next version of the API....the APIKey will be a required parameter and SessionID will be optional if people specifically want to use sessions.

jfriend

devbobo wrote: »

Your observations regarding shiz's slideshow aren't entirely correct. For any method call that requires the SessionID if the SessionID isn't sent, the session cookie is loaded instead.

So Sam calls smugmug.images.get, if that fails he calls smugmug.login.anonymously, then recalls smugmug.images.get.

As I previously state, the next version of the API....the APIKey will be a required parameter and SessionID will be optional if people specifically want to use sessions.

When do you anticipate this next version of the API being out? I saw the shizam slideshow working while the site was in read-only mode and my slideshow was not able to. I checked a network trace of the shizam slideshow and saw it only using smugmug.images.get.

When will smugmug.images.get succeed with the APIKey and not the sessionID? I've seen it succeed, but also seen it fail?

What does it mean "the session cookie is loaded instead"? Is that something I can code also? I wanted to release the slideshow next week or the week after, but I'd like to solve this issue before release. Unlike the built-in Smugmug code, it's not easy to deliver upgrades after people install a customization (I can't do it for them, they have to manually install a new version of the code).

jfriend

jfriend wrote: »

When do you anticipate this next version of the API being out? I saw the shizam slideshow working while the site was in read-only mode and my slideshow was not able to. I checked a network trace of the shizam slideshow and saw it only using smugmug.images.get.

When will smugmug.images.get succeed with the APIKey and not the sessionID? I've seen it succeed, but also seen it fail?

What does it mean "the session cookie is loaded instead"? Is that something I can code also? I wanted to release the slideshow next week or the week after, but I'd like to solve this issue before release. Unlike the built-in Smugmug code, it's not easy to deliver upgrades after people install a customization (I can't do it for them, they have to manually install a new version of the code).

Bump.

jfriend

jfriend wrote: »

When do you anticipate this next version of the API being out? I saw the shizam slideshow working while the site was in read-only mode and my slideshow was not able to. I checked a network trace of the shizam slideshow and saw it only using smugmug.images.get.

When will smugmug.images.get succeed with the APIKey and not the sessionID? I've seen it succeed, but also seen it fail?

What does it mean "the session cookie is loaded instead"? Is that something I can code also? I wanted to release the slideshow next week or the week after, but I'd like to solve this issue before release. Unlike the built-in Smugmug code, it's not easy to deliver upgrades after people install a customization (I can't do it for them, they have to manually install a new version of the code).

Can I get any help here? 5 days ago I asked some questions that are important in helping me finish my new slideshow customization. I'm trying to figure out how to get it to work when the site is in read-only mode. The Shizam slideshow does work in site read-only mode, but since it's source code is hidden, I can't see how it does that.

I know that smugmug.images.get sometimes works with an APIKey instead of a session, but I also know that it doesn't always work. I have no idea why sometimes it doesn't work.

I know that if I login.anonymously and then use that session with smugmug.images.get works reliably as long as the site is not in read-only mode, but does not work in read-only mode.

So, my latest guess is to first try smugmug.images.get with the APIKey. It that works, I'm good. If that fails, I then try to login anonymously and use smugmug.images.get with the session.

Is this advisable? supported? the way that the Shizam slideshow does it? Is there a better way to perform reliably and continue to work when the site is in read-only mode? Please advise.

I didn't understand the earlier references to the session cookie. Am I supposed to do anything with cookies?

Andy

John, David's off on holiday right now but I've made sure he's seen your message. I'll see if Sam can help too.

Shizam

jfriend wrote: »

So, my latest guess is to first try smugmug.images.get with the APIKey. It that works, I'm good. If that fails, I then try to login anonymously and use smugmug.images.get with the session.

Is this advisable? supported? the way that the Shizam slideshow does it? Is there a better way to perform reliably and continue to work when the site is in read-only mode? Please advise.

Yup
what I do is first just try smugmug.images.get, if the user has a session in their cookies, that API request will use it and succeed. The advantage here is that the session in their cookied session has any information about their login or what galleries they've entered passwords for. If that first request fails THEN I do a Anon login and use that session.

As Dev mentions, 1.3.0 allows you to do things w/out having to login at all which, among other things, allows things to continue working in RO mode.

jfriend

Shizam wrote: »

Yup
what I do is first just try smugmug.images.get, if the user has a session in their cookies, that API request will use it and succeed. The advantage here is that the session in their cookied session has any information about their login or what galleries they've entered passwords for. If that first request fails THEN I do a Anon login and use that session.

As Dev mentions, 1.3.0 allows you to do things w/out having to login at all which, among other things, allows things to continue working in RO mode.

Thanks Shizam. Is 1.3.0 out yet?

Shizam

Doesn't look like it, 1.2.2 documentation is public but 1.3.0 appears to be private, still a work in progress.

jfriend

Shizam wrote: »

Doesn't look like it, 1.2.2 documentation is public but 1.3.0 appears to be private, still a work in progress.

Thanks Shizam. I've verified what you said in a test. If no session cookie, the direct smugmug.images.get with APIKey doesn't work. If session cookie, it works.

If the typical viewer is not a smugmug customer and therefore doesn't have a session cookie, it would be slower to try smugmug.images.get, fail, then go back to login. In an attempt to get the results with one roundtrip, we'd end up with three roundtrips instead of two. Since 1.3.0 will be a better solution, I guess I'll just stay with my login code for now and switch to 1.3.0 and just a smugmug.images.get when it comes out.

jfriend

jfriend wrote: »

Thanks Shizam. I've verified what you said in a test. If no session cookie, the direct smugmug.images.get with APIKey doesn't work. If session cookie, it works.

If the typical viewer is not a smugmug customer and therefore doesn't have a session cookie, it would be slower to try smugmug.images.get, fail, then go back to login. In an attempt to get the results with one roundtrip, we'd end up with three roundtrips instead of two. Since 1.3.0 will be a better solution, I guess I'll just stay with my login code for now and switch to 1.3.0 and just a smugmug.images.get when it comes out.

Shizam, if you're still around this forum, do you know which cookie is the key for when the straight smugmug.images.get will work with APIKey without logging in first? I'd like to only call the naked smugmug.images.get when I know it's probably going to work, saving a roundtrip when it isn't likely to work. Is it the _ss cookie?

Shizam

The cookie that stores your session is the SMSESS cookie. The problem w/relying on it though is everybody who visits the site gets a session regardless of their login/password status so one session might be for somebody who his logged in and another session might just be a guest who landed on the homepage.

jfriend

Shizam wrote: »

The cookie that stores your session is the SMSESS cookie. The problem w/relying on it though is everybody who visits the site gets a session regardless of their login/password status so one session might be for somebody who his logged in and another session might just be a guest who landed on the homepage.

Hmmm. OK, then that idea won't work I guess. Shizam, can you confirm that when the site is in read-only mode that smugmug.image.get with an APIKey instead of a session will just work regardless of cookie state? How does your slideshow get the image list for a gallery when the site is in read-only mode?

I'm asking because I still don't have something that is working when the site's in read-only mode (found that out last night). And, of course, I have no way of testing anything in read-only mode except trying to catch it in action on Thursdays.

Shizam

I just tested this in my sandbox and yes, when the site is in RO mode a request for images.get with an APIKey (and AlbumID&AlbumKey) returns data. Won't work for password protected galleries obviously.

jfriend

Shizam wrote: »

I just tested this in my sandbox and yes, when the site is in RO mode a request for images.get with an APIKey (and AlbumID&AlbumKey) returns data. Won't work for password protected galleries obviously.

Thanks for your help.