I am using GWT for my client side application. I am not using GWT/Java for the server. However, I am not sure how I can handle session management. The GWT application resides on one page, all server calls are done via AJAX. If a session expires on the server… let’s assume the user didn’t close the browser, but left the application open, how could my server notify the application that the session has expired and that the client side portion should show the login screen again?
What is meant by client side session management? That seems inherently insecure.
I’m not looking for code. I’m looking for ideas, techniques, potential solutions etc. I’ve considered Comet http://en.wikipedia.org/wiki/Comet_(programming), but that doesn’t seem like that will work very well without using Java on the server side. Maybe, I’m wrong? I don’t want to poll the server either.
Any thoughts or insight?
Without knowing how you’re doing your RPC is working, its hard to give good advice.
If your AJAX service requires a user to be authenticated (IE have a valid session), it is ok to just send a 401 error saying that the user is invalid. Client-side can interpret the 401 error as a message that it should set the user up for re-authentication.