Question

I have GWT application and I want to secure it using spring security. I have my custom popup window where the login formular based on UI Binder is placed. I want to send credentials to server using RPC methods and then authenticate user against DB. Is that possible?

Answer 1

Yes, it’s possible, but you must consider, that GWT application is compiled into javascript and sent as an entire package to the client. So access to ‘static’ places, which does not retrieve data from server cannot be restricted using SI, since all the information is available on the client side from the very beginning. However, all request factory services (or other protocol you use) can be secured using Spring Security. If you use request factory you have to do couple of things:

1. Implement security mechanism as in any other application using Spring Security – you must expose j_spring_security_check endpoint allowing user to authenticate and add appropriate SI annotations on the services level (if it requires authentication / authorization settings)
2. Override DefaultRequestTransport createRequestCallback(RequestTransport.TransportReceiver receiver) method in order to be able to handle 403/401 server responses.
3. Introduce login page which sends user provided credentials to the j_spring_security_check. You can use GWT RequestBuilder easily to do it.

That’s it!

Edit:
Of course spring must be aware of services you are securing (must exist within its container).