GWT same origin policy workaround? - gwt

Question

Assume that I have a website whose static assets are hosted in CDN (say, AWS CloudFront), however, all the GWT-RPC calls will be handled in the domain hosts. How can I achieve this in GWT?

Answer 1

As #robert mentioned, CORS is another option, but it doesn't require any changes in your client-side code - if the browser is new enough to support CORS at all, then all you do is make the call to the remote server, and make sure that the remote server supports it.
Depending on which server you are using, the support will be slightly different. https://www.w3.org/wiki/CORS_Enabled has a list of different servers and how you might enable CORS, depending on what you are using, and whether you enable it across your entire server, or just in a single part of the application.
For example, in Jetty:
<filter>
<filter-name>cross-origin</filter-name>
<filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>cross-origin</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
While in Tomcat:
CorsFilter
org.apache.catalina.filters.CorsFilter
CorsFilter
/*
It is also possible to modify your RemoteServiceServlet class to handle this, but it comes with the disadvantage of needing to more fully understand the spec and make sure you handle it all correctly.
As with JSONP, there are important security implications of allowing cross-domain requests. Unlike JSONP, the CORS spec includes features to mitigate this, and ensure that the browser doesn't attempt to make calls to your remote server from the wrong host page - you can restrict calls so that they only come from specific domains. The specific header is Access-Control-Allow-Origin, and while it can be assigned to *, meaning "all servers", you likely want to restrict it to avoid potential XSRF attacks against your application - for the above examples this is managed via init-parameters, check your container's documentation for specific details. Additionally, changing the url-pattern can restrict the urls that these filters apply to can limit what can be requested remotely.

Answer 2

You could try to use CORS (https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)
Something like this:
public class CrossSiteRpcRequestBuilder extends RpcRequestBuilder {
#Override
protected RequestBuilder doCreate(String serviceEntryPoint) {
RequestBuilder requestBuilder=super.doCreate(serviceEntryPoint);
requestBuilder.setIncludeCredentials(true);
return requestBuilder;
}
}
public class CrossSiteRpcRequestBuilderFactory {
public RpcRequestBuilder get() {
return new CrossSiteRpcRequestBuilder();
}
}
RpcRequestBuilder rpcRequestBuilder=((CrossSiteRpcRequestBuilderFactory) GWT.create(CrossSiteRpcRequestBuilderFactory.class)).get();
rpcRequestBuilder.create("{YOUR_HOST}/cors_handshake");
rpcRequestBuilder.setContentType("text/x-gwt-rpc; charset=utf-8");
rpcRequestBuilder.setRequestData("cors handshake");
rpcRequestBuilder.setCallback(new RequestCallback() {
...
});
RequestBuilder r=rpcRequestBuilder.finish();
r.send();
An alternative would be to use your server as a proxy to the remote server (bandwidth).
In conclusion:
I would use JsonpRequestBuilder instead of RPC, its less convenient, but guaranteed to work (unlike CORS).
See http://www.gwtproject.org/doc/latest/tutorial/Xsite.html for details.