Slide 1
Slide 1 text
Leverage HTTP
to deliver
cacheable websites
By Thijs Feryn
Slide 2
Slide 2 text
Caching
Slide 3
Slide 3 text
Don’t
recompute
if the data
hasn’t
changed
Slide 4
Slide 4 text
Hi, I’m Thijs
Slide 5
Slide 5 text
I’m
@ThijsFeryn
on Twitter
Slide 6
Slide 6 text
I’m an
Evangelist
At
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
Afterthought
Slide 9
Slide 9 text
What if we
could design
our software
with HTTP
caching in
mind?
Slide 10
Slide 10 text
✓Portability
✓Developer empowerment
✓Control
✓Consistent caching behavior
Caching state of mind
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
No content
Slide 13
Slide 13 text
Reverse
caching
proxy
Slide 14
Slide 14 text
Normally
User Server
Slide 15
Slide 15 text
With ReCaPro *
User ReCaPro Server
* Reverse Caching Proxy
Slide 16
Slide 16 text
No content
Slide 17
Slide 17 text
No content
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
No content
Slide 20
Slide 20 text
Any other
CDN
Slide 21
Slide 21 text
Speaks HTTP
Slide 22
Slide 22 text
HTTP caching mechanisms
Expires: Sat, 09 Sep 2017 14:30:00 GMT
Cache-control: public, max-age=3600,
s-maxage=86400
Cache-control: private, no-cache, no-store
Slide 23
Slide 23 text
In an ideal world
Slide 24
Slide 24 text
✓Stateless
✓Idempotent
✓Well-defined TTL
✓Cache / no-cache per
resource
✓Cache variations
✓Conditional requests
In an ideal world
Slide 25
Slide 25 text
Reality
sucks
Slide 26
Slide 26 text
Common
problems
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
No content
Slide 29
Slide 29 text
Time To Live
Slide 30
Slide 30 text
Cache variations
Slide 31
Slide 31 text
Authentication
Slide 32
Slide 32 text
Legacy
Slide 33
Slide 33 text
Introducing
the demo app
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
Silex framework
Slide 36
Slide 36 text
Twig templates
Slide 37
Slide 37 text
✓Multi-lingual (Accept-Language)
✓Nav
✓Header
✓Footer
✓Main
✓Login page & private content
Introducing the app
Slide 38
Slide 38 text
No content
Slide 39
Slide 39 text
register(new Silex\Provider\TwigServiceProvider(),
['twig.path' => __DIR__.'/../views']);
$app->register(new Silex\Provider\TranslationServiceProvider(),
['locale_fallbacks' => ['en','nl']]);
$app->register(new Silex\Provider\SessionServiceProvider());
$app->extend('translator', function($translator, $app) {
$translator->addLoader('yaml', new YamlFileLoader());
$translator->addResource('yaml', dirname(__DIR__).'/locales/en.yml', 'en');
$translator->addResource('yaml',dirname( __DIR__).'/locales/nl.yml', 'nl');
return $translator;
});
$app['credentials'] = [
'admin' => '$2y$10$431rvq1qS9ewNFP0Gti/o.kBbuMK4zs8IDTLlxm5uzV7cbv8wKt0K'
];
$app->before(function (Request $request) use ($app){
$request->setLocale($request->getPreferredLanguage());
$app['translator']->setLocale($request->getPreferredLanguage());
});
$app->after(function(Request $request, Response $response) use ($app){
$response->headers->set('Content-Length',strlen($response->getContent()));
});
Slide 40
Slide 40 text
$app->get('/', function () use($app) {
if($app['session']->has('username')) {
$loginLogoutUrl = $app['url_generator']->generate('logout');
$loginLogoutLabel = 'log_out';
} else {
$loginLogoutUrl = $app['url_generator']->generate('login');
$loginLogoutLabel = 'log_in';
}
$response = new Response($app['twig']->render('index.twig',
['loginLogoutUrl'=>$loginLogoutUrl,'loginLogoutLabel'=>$loginLogoutLabel]),200);
return $response;
})->bind('home');
$app->get('/login', function (Request $request) use($app) {
if($app['session']->has('username')) {
return new RedirectResponse($app['url_generator']->generate('home'));
}
$response = new Response($app['twig']->render('login.twig'),200);
return $response;
})->bind('login');
$app->get('/logout', function () use($app) {
$response = new RedirectResponse($app['url_generator']->generate('login'));
$app['session']->invalidate();
return $response;
})->bind('logout');
Routes
Slide 41
Slide 41 text
{% block title %}{% endblock %} - Developing cacheable websites
script>
</head>
<body>
<div class="container-fluid">
{{ include('header.twig') }}
<div class="row">
<div class="col-sm-3 col-lg-2">
{{ include('nav.twig') }}
</div>
<div class="col-sm-9 col-lg-10">
{% block content %}{% endblock %}
</div>
</div>
{{ include('footer.twig') }}
</div>
</body>
</html>
Base
template
Slide 42
Slide 42 text
{% extends "base.twig" %}
{% block title %}Home{% endblock %}
{% block content %}
{{ 'example' | trans }} {{ 'rendered' | trans({'%date%':"now"|date("Y- m-d H:i:s")}) }}
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Mauris consequat orci eget libero sollicitudin, non ultrices turpis mollis. Aliquam sit amet tempus elit. Ut viverra risus enim, ut venenatis justo accumsan nec. Praesent a dolor tellus. Maecenas non mauris leo. Pellentesque lobortis turpis at dapibus laoreet. Mauris rhoncus nulla et urna mollis, et lobortis magna ornare. Etiam et sapien consequat, egestas felis sit amet, dignissim enim.
Quisque quis mollis justo, imperdiet fermentum velit. Aliquam nulla justo, consectetur et diam non, luctus commodo metus. Vestibulum fermentum efficitur nulla non luctus. Nunc lorem nunc, mollis id efficitur et, aliquet sit amet ante. Sed ipsum turpis, vehicula eu semper eu, malesuada eget leo. Vestibulum venenatis dui id pulvinar suscipit. Etiam nec massa pharetra justo pharetra dignissim quis non magna. Integer id convallis lectus. Nam non ullamcorper metus. Ut vestibulum ex ut massa posuere tincidunt. Vestibulum hendrerit neque id lorem rhoncus aliquam. Duis a facilisis metus, a faucibus nulla.
{% endblock %} Home page templateSlide 43
Slide 43 text
{{ 'welcome'|trans }}
{{ 'rendered' | trans({'%date%':"now"|date("Y-m-d H:i:s")}) }} small>Slide 44
Slide 44 text
Footer {{ 'rendered' | trans({'%date%':"now"|date("Y-m-d H:i:s")}) }} Footer template
Slide 45
Slide 45 text
{{ 'rendered' | trans({'%date%':"now"|date("Y-m-d H:i:s")}) }}
Navigation
template
Slide 46
Slide 46 text
home: Home
welcome : Welcome to the site
rendered : Rendered at %date%
example : An example page
log_in : Log in
login : Login
log_out : Log out
username : Username
password : Password
private : Private
privatetext : Looks like some very private data
English locale
file
Slide 47
Slide 47 text
home: Start
welcome : Welkom op de site
rendered : Samengesteld op %date%
example : Een voorbeeldpagina
log_in : Inloggen
login : Login
log_out : Uitloggen
username : Gebruikersnaam
password : Wachtwoord
private : Privé
privatetext : Deze tekst ziet er vrij privé uit
Dutch locale
file
Slide 48
Slide 48 text
No content
Slide 49
Slide 49 text
The mission
Maximum
Cacheability
Slide 50
Slide 50 text
Cache-control
Slide 51
Slide 51 text
$app->register(new HttpFragmentServiceProvider());
$app->register(new HttpCacheServiceProvider());
Register
providers
Slide 52
Slide 52 text
$app->get('/', function () use($app) {
$response = new Response($app['twig']->render('index.twig'),200);
$response
->setSharedMaxAge(500)
->setPublic();
return $response;
})->bind('home');
Cache-Control: public, s-maxage=500
Slide 53
Slide 53 text
$app->get('/private', function () use($app) {
if(!$app['session']->has('username')) {
return new RedirectResponse($app['url_generator']-
>generate('login'));
}
$response = new Response($app['twig']->render('private.twig'),200);
$response->headers->addCacheControlDirective('no-store', true);
$response->headers->addCacheControlDirective('no-cache', true);
$response
->setSharedMaxAge(0)
->setPrivate();
return $response;
})->bind('private');
Cache-Control: private, no-cache, no-store, s-maxage=0
Slide 54
Slide 54 text
Doesn't
work
Slide 55
Slide 55 text
PHPSESSID
cookie
No cache
Slide 56
Slide 56 text
Block caching
Slide 57
Slide 57 text
No content
Slide 58
Slide 58 text
Code
renders
single HTTP
response
Slide 59
Slide 59 text
Lowest
common
denominator:
no cache
Slide 60
Slide 60 text
Edge Side Includes
✓Placeholder
✓Parsed by Varnish
✓Output is a composition of blocks
✓State per block
✓TTL per block
Slide 61
Slide 61 text
sub vcl_recv {
set req.http.Surrogate-Capability = "key=ESI/1.0";
}
sub vcl_backend_response {
if (beresp.http.Surrogate-Control ~ "ESI/1.0") {
unset beresp.http.Surrogate-Control;
set beresp.do_esi = true;
}
}
Edge Side Includes
Slide 62
Slide 62 text
ESI
vs
AJAX
Slide 63
Slide 63 text
Choose wisely
ESI, parsed by
Varnish
HInclude,
parsed by
Javascript
Slide 64
Slide 64 text
HttpFragmentServiceProvider
ESI
&
HInclude
support
Slide 65
Slide 65 text
Subrequests
Slide 66
Slide 66 text
{{ include('header.twig') }}
{{ include('footer.twig') }}
{{ include('nav.twig') }}
{% block content %}{% endblock %}
{{ render_esi(url('header')) }}
{{ render_hinclude(url('footer')) }}
{{ render_esi(url('nav')) }}
{% block content %}{% endblock %}
Slide 67
Slide 67 text
An example page Rendered at 2017-05-17 16:57:14 small>
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Mauris consequat orci eget libero sollicitudin,…
Slide 68
Slide 68 text
$app->get('/header', function () use($app) {
$response = new Response($app['twig']->render('header.twig'),200);
$response
->setSharedMaxAge(500)
->setPublic();
return $response;
})->bind('header');
$app->get('/footer', function () use($app) {
$response = new Response($app['twig']->render('footer.twig'),200);
$response
->setSharedMaxAge(500)
->setPublic();
return $response;
})->bind('footer');
$app->get('/nav', function (Request $request) use($app) {
if($app['session']->has('username')) {
$loginLogoutUrl = $app['url_generator']->generate('logout');
$loginLogoutLabel = 'log_out';
} else {
$loginLogoutUrl = $app['url_generator']->generate('login');
$loginLogoutLabel = 'log_in';
}
$response = new Response($app['twig']->render('nav.twig',
['loginLogoutUrl'=>$loginLogoutUrl,'loginLogoutLabel'=>$loginLogoutLabel]),200);
$response->headers->addCacheControlDirective('no-store', true);
$response->headers->addCacheControlDirective('no-cache', true);
$response
->setSharedMaxAge(0)
->setPrivate();
return $response;
})->bind('nav');
Separate
routes per
block
Slide 69
Slide 69 text
Problem:
no language
cache
variation
Slide 70
Slide 70 text
Vary: Accept-Language
Slide 71
Slide 71 text
$app->after(function(Request $request, Response $response) use ($app)
{
$response->headers->set('Content-Length',
strlen($response->getContent()));
});
$app->after(function(Request $request, Response $response) use ($app)
{
$response->setVary('Accept-Language',false);
$response->headers->set('Content-Length',
strlen($response->getContent()));
});
Slide 72
Slide 72 text
No content
Slide 73
Slide 73 text
No content
Slide 74
Slide 74 text
Improvements:
conditional
requests
Slide 75
Slide 75 text
Conditional requests
HTTP/1.1 200 OK
Host: localhost
Etag: 7c9d70604c6061da9bb9377d3f00eb27
Content-type: text/html; charset=UTF-8
Hello world output
GET /if_none_match.php HTTP/1.1
Host: localhost
User-Agent: curl/7.48.0
Slide 76
Slide 76 text
Conditional requests
HTTP/1.0 304 Not Modified
Host: localhost
Etag: 7c9d70604c6061da9bb9377d3f00eb27
GET /if_none_match.php HTTP/1.1
Host: localhost
User-Agent: curl/7.48.0
If-None-Match:
7c9d70604c6061da9bb9377d3f00eb27
Slide 77
Slide 77 text
Conditional requests
HTTP/1.1 200 OK
Host: localhost
Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT
Content-type: text/html; charset=UTF-8
Hello world output
GET /if_none_match.php HTTP/1.1
Host: localhost
User-Agent: curl/7.48.0
Slide 78
Slide 78 text
Conditional requests
HTTP/1.0 304 Not Modified
Host: localhost
Last-Modified: Fri, 22 Jul 2016 10:11:16 GMT
GET /if_none_match.php HTTP/1.1
Host: localhost
User-Agent: curl/7.48.0
If-Modified-Since: Fri, 22 Jul 2016 10:11:16
GMT
Slide 79
Slide 79 text
Varnish supports
conditional requests
client-side & server-side
Slide 80
Slide 80 text
$app->after(function(Request $request, Response $response) use ($app)
{
$response->setVary('Accept-Language',false)
$response->headers->set('Content-Length',
strlen($response->getContent()));
});
$app->after(function(Request $request, Response $response) use ($app)
{
$response
->setETag(md5($response->getContent()))
->setVary('Accept-Language',false)
->isNotModified($request);
$response->headers->set('Content-Length',
strlen($response->getContent()));
});
Slide 81
Slide 81 text
✓Navigation page
✓Private page
Weak spots
Not cached
because of
stateful content
Slide 82
Slide 82 text
Move state client-side
Slide 83
Slide 83 text
Replace PHP session with
JSON Web Tokens
Slide 84
Slide 84 text
JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pb
iIsImV4cCI6MTQ5NTUyODc1NiwibG9naW4iOnRydWV9.u4Idy-
SYnrFdnH1h9_sNc4OasORBJcrh2fPo1EOTre8
✓3 parts
✓Dot separated
✓Base64 encoded JSON
✓Header
✓Payload
✓Signature (HMAC with secret)
Slide 85
Slide 85 text
eyJzdWIiOiJhZG1pbiIsIm
V4cCI6MTQ5NTUyODc1Niwi
bG9naW4iOnRydWV9
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "admin",
"exp": 1495528756,
"login": true
}
HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
secret
)
eyJhbGciOiJIUzI1NiIsI
nR5cCI6IkpXVCJ9
u4Idy-
SYnrFdnH1h9_sNc4OasOR
BJcrh2fPo1EOTre8
Slide 86
Slide 86 text
JWT
Cookie:token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJz
dWIiOiJhZG1pbiIsImV4cCI6MTQ5NTUyODc1NiwibG9naW4iOnRydW
V9.u4Idy-SYnrFdnH1h9_sNc4OasORBJcrh2fPo1EOTre8
✓Stored in a cookie
✓Can be validated by Varnish
✓Payload can be processed by
any language (e.g. Javascript)
Slide 87
Slide 87 text
VCL
vcl 4.0;
import digest;
import std;
import cookie;
import var;
backend default {
.host = "localhost";
.port = "8080";
}
Init
Slide 88
Slide 88 text
VCL
sub vcl_recv {
var.set("key","SlowWebSitesSuck");
set req.url = std.querysort(req.url);
if(req.http.accept-language ~ "^\s*(nl)") {
set req.http.accept-language = regsub(req.http.accept-
language,"^\s*(nl).*$","\1");
} else {
set req.http.accept-language = "en";
}
set req.http.Surrogate-Capability="key=ESI/1.0";
if ((req.method != "GET" && req.method != "HEAD") || req.http.Authorization)
{
return (pass);
}
call jwt;
if(req.url == "/private" && req.http.X-Login != "true") {
return(synth(302,"/logout"));
}
return(hash);
}
Receive
request
Slide 89
Slide 89 text
VCL
sub vcl_backend_response {
set beresp.http.x-host = bereq.http.host;
set beresp.http.x-url = bereq.url;
if(beresp.http.Surrogate-Control~"ESI/1.0") {
unset beresp.http.Surrogate-Control;
set beresp.do_esi=true;
return(deliver);
}
}
sub vcl_deliver {
unset resp.http.x-host;
unset resp.http.x-url;
unset resp.http.vary;
}
sub vcl_synth {
if (resp.status == 301 || resp.status == 302) {
set resp.http.location = resp.reason;
set resp.reason = "Moved";
return (deliver);
}
}
Receive
backend
response
Strip
headers
Custom
redirect
logic
Slide 90
Slide 90 text
sub jwt {
if(req.http.cookie ~ "^([^;]+;[ ]*)*token=[^\.]+\.[^\.]+\.[^\.]+([ ]*;[^;]+)*$") {
cookie.parse(req.http.cookie);
cookie.filter_except("token");
var.set("token", cookie.get("token"));
var.set("header", regsub(var.get("token"),"([^\.]+)\.[^\.]+\.[^\.]+","\1"));
var.set("type", regsub(digest.base64url_decode(var.get("header")),{"^.*?"typ"\s*:
\s*"(\w+)".*?$"},"\1"));
var.set("algorithm", regsub(digest.base64url_decode(var.get("header")),{"^.*?"alg"\s*:
\s*"(\w+)".*?$"},"\1"));
if(var.get("type") != "JWT" || var.get("algorithm") != "HS256") {
return(synth(400, "Invalid token"));
}
var.set("rawPayload",regsub(var.get("token"),"[^\.]+\.([^\.]+)\.[^\.]+$","\1"));
var.set("signature",regsub(var.get("token"),"^[^\.]+\.[^\.]+\.([^\.]+)$","\1"));
var.set("currentSignature",digest.base64url_nopad_hex(digest.hmac_sha256(var.get("key"),var.ge
t("header") + "." + var.get("rawPayload"))));
var.set("payload", digest.base64url_decode(var.get("rawPayload")));
var.set("exp",regsub(var.get("payload"),{"^.*?"exp"\s*:\s*(\w+).*?$"},"\1"));
var.set("username",regsub(var.get("payload"),{"^.*?"sub"\s*:\s*"(\w+)".*?$"},"\1"));
if(var.get("signature") != var.get("currentSignature")) {
return(synth(400, "Invalid token"));
}
if(var.get("username") ~ "^\w+$") {
if(std.time(var.get("exp"),now) >= now) {
set req.http.X-Login="true";
} else {
set req.http.X-Login="false";
}
}
}
}
Slide 91
Slide 91 text
cookie.parse(req.http.cookie);
cookie.filter_except("token");
var.set("token", cookie.get("token"));
var.set("header", regsub(var.get("token"),"([^\.]+)\.[^\.]+\.[^\.]+","\1"));
var.set("type", regsub(digest.base64url_decode(var.get("header")),
{"^.*?"typ"\s*:\s*"(\w+)".*?$"},"\1"));
var.set("algorithm", regsub(digest.base64url_decode(var.get("header")),
{"^.*?"alg"\s*:\s*"(\w+)".*?$"},"\1"));
if(var.get("type") != "JWT" || var.get("algorithm") != "HS256") {
return(synth(400, "Invalid token"));
}
Validate
JWT header
Slide 92
Slide 92 text
var.set("rawPayload",regsub(var.get("token"),"[^\.]+\.([^\.]+)\.[^\.]+
$","\1"));
var.set("payload", digest.base64url_decode(var.get("rawPayload")));
var.set("exp",regsub(var.get("payload"),{"^.*?"exp"\s*:\s*(\w+).*?$"},"\1"));
var.set("username",regsub(var.get("payload"),{"^.*?"sub"\s*:\s*"(\w+)".*?
$"},"\1"));
Get
payload
Slide 93
Slide 93 text
var.set("signature",regsub(var.get("token"),"^[^\.]+\.[^\.]+\.([^\.]+)
$","\1"));
var.set("currentSignature",digest.base64url_nopad_hex(digest.hmac_sha256(var.
get("key"),var.get("header") + "." + var.get("rawPayload"))));
if(var.get("signature") != var.get("currentSignature")) {
return(synth(400, "Invalid token"));
}
Verify
signature
Slide 94
Slide 94 text
if(var.get("username") ~ "^\w+$") {
if(std.time(var.get("exp"),now) >= now) {
set req.http.X-Login="true";
} else {
set req.http.X-Login="false";
}
}
Verify
login action
Check
expiration
Use X-
Login in
vcl_recv
Slide 95
Slide 95 text
$app['jwtKey'] = 'SlowWebSitesSuck';
$app['jwtEncode'] = function() use ($app){
return function($username) use ($app) {
return JWT::encode([
'sub'=>$username,
'exp'=>time() + 86400,
'login'=>true,
],$app['jwtKey']);
};
};
$app['jwtValidate'] = function() use ($app) {
return function($token) use ($app) {
try {
$data = JWT::decode($token,$app['jwtKey'],['HS256']);
$data = (array)$data;
if(!isset($app['credentials'][$data['sub']])) {
return false;
}
return true;
} catch(UnexpectedValueException $e) {
return false;
}
};
};
The code
Helper
functions
Slide 96
Slide 96 text
$app->get('/private', function (Request $request) use($app) {
if(!$app['jwtValidate']($request->cookies->get('token'))) {
return new RedirectResponse($app['url_generator']->generate('login'));
}
$response = new Response($app['twig']->render('private.twig'),200);
$response
->setSharedMaxAge(500)
->setPublic();
return $response;
})->bind('private');
The code
Redirect
to login
page
Slide 97
Slide 97 text
$app->get('/nav', function (Request $request) use($app) {
if($app['jwtValidate']($request->cookies->get('token'))) {
$loginLogoutUrl = $app['url_generator']->generate('logout');
$loginLogoutLabel = 'log_out';
} else {
$loginLogoutUrl = $app['url_generator']->generate('login');
$loginLogoutLabel = 'log_in';
}
$response = new Response($app['twig']->render('nav.twig',
['loginLogoutUrl'=>$loginLogoutUrl,'loginLogoutLabel'=>$loginLogoutLabel]
),200);
$response
->setVary('X-Login',false)
->setSharedMaxAge(500)
->setPublic();
return $response;
})->bind('nav');
The code
Cache
variation
Slide 98
Slide 98 text
Bonus
Slide 99
Slide 99 text
function getCookie(name) {
var value = "; " + document.cookie;
var parts = value.split("; " + name + "=");
if (parts.length == 2) return parts.pop().split(";").shift();
}
function parseJwt (token) {
var base64Url = token.split('.')[1];
var base64 = base64Url.replace('-', '+').replace('_', '/');
return JSON.parse(window.atob(base64));
};
$(document).ready(function(){
if ($.cookie('token') != null ){
var token = parseJwt($.cookie("token"));
$("#usernameLabel").html(', ' + token.sub);
}
});
Parse JWT
in Javascript
Slide 100
Slide 100 text
Does not require
backend access
Slide 101
Slide 101 text
✓Application issues JWT
✓Varnish validates JWT
✓Varnish can verify login
✓Varnish can redirect to login page
✓No backend access required
✓Only POST /login hits the backend
✓Even works without Varnish
✓Even Javascript can parse JWT
JWT conclusion
Slide 102
Slide 102 text
https://github.com/ThijsFeryn/
cacheable-site-silex/tree/v2
Slide 103
Slide 103 text
✓Cache-control
✓Accept-Language
✓Vary
✓E-Tag
✓If-none-match
✓ESI
✓AJAX (HInclude)
✓JWT
Summary
Slide 104
Slide 104 text
No content
Slide 105
Slide 105 text
No content
Slide 106
Slide 106 text
https://twitter.com/thijsferyn
https://instagram.com/thijsferyn
https://blog.feryn.eu
https://talks.feryn.eu
https://book.feryn.eu
https://youtube.com/thijsferyn
https://soundcloud.com/thijsferyn
http://itunes.feryn.eu