Home/ Questions/Q 8388869
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T18:34:01+00:00

I recently watched a video from Google I/O on Best Practices for GWT Security,

  • 0

I recently watched a video from Google I/O on Best Practices for GWT Security, and one of the strong recommendations from the speaker was to actually separate your app into two different apps:

  • Login App – used to present a login screen and authenticate a user for the Primary App; and
  • Primary App – the rest of your app

His reasoning for this is that all client-side code can be compromised, even with GWT’s insane obfuscation methods. Don’t open yourself up to unnecessary attack, so by having two separate apps, an attacker (who is not authorized to even login and use the system) will only be able to pull down the client-side code of the Login App without getting his hands on the Primary App‘s client-side code.

I like this approach, but plan on deploying my app(s) to GAE, which strictly prohibits you from using multiple apps (WARs) to coordinate with each other (explicitly says so in the Terms & Conditions!).

So it seems that the Google Developers themselves have a disagreement here! On one hand, the GWT team wants your app broken up for security purposes, but then the GAE team doesn’t want 2+ apps being “in league” with each other for billing purposes. My impression is that Google wants developers to embrace their entire platform, using both GWT and GAE.

So what’s the deal here?!? Is there any way to break up my codebase without producing a separate WAR (thus appeasing GAE) but in such a way that there’s no way to see my Primary App‘s code until you log in?

I would think “yes”, however GWT forces you to download everything all at once (to minimize roundtrips and expensive HTTP requests). Any ideas? Thanks in advance!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I think the idea would be to have separate modules in GWT to do the login and run the real application.

    You might see for example:
    https://github.com/ashtonthomas/GwtAdvancedLogin

    This Google Web Toolkit (GWT) application is an example of how to
    create a separate Login Module which then funnels to one or many other
    modules that contain the main applicaiton login.

    You can use this type of setup to take full control over you login
    page while not including it in your main module.

    BTW, Gwt does not force you to download everything at once. You can easily split the code.
    https://developers.google.com/web-toolkit/doc/latest/DevGuideCodeSplitting

    I would think having separate modules is what you want though as opposed to code splitting though.

    • 0