Question

My application has some features that are accessible to all users, and some other features to which access should be restricted to authenticated users only. All these restricted features exists within some set of GWT Places, thus, all Places available in application can be divided into two groups: “accessible for all”, and “restricted”. In my opinion, places with restricted access, could implement some interface (let’s say it would be RestrictedAccess), and if user proceeds to one of them, and it has not been authenticated yet, it will be redirected to the login screen – it’s more OO-approach than applying filters basis on URL.

What I’m trying to achieve is:

1. Information about if user has been
   authenticated or not should be
   stored on server (it’s not something
   that could be stored in a cookie…)
2. Login page is a standard GWT place+view+activity (!)
3. User name & password validation is done on the server side.

So far, I’ve introduced RestrictedAccess interface, which is implemented by some set of places. My FilteredActivityMapper.Filter implementation, which is passed to the FilteredActivityMapper wrapping application activity mapper has the following logic:

Place filter(Place place) {
    if (place instanceof RestrictedAccess && !userHasBeenAuthenticated()) {
      return new LoginPlace();
    }

    // return the original place - user has been already authenticated or
    // place is accesible for all users
    return place;
}


private boolean userHasBeenAuthenticated() {
    // remote call - how to do ???
}

The problem is with userHasBeenAuthenticated() method (user should not be redirected to the LoginPlace, if it has been already authenticated). If I want to store this information on the server-side, I have to do GWT RPC/request factory call here, but both are asynchronous, so I cannot work on its result in the filter method.

I know that I can use web.xml filters or some external framework (e.g. spring security), but none of this approach allows me to have login page as a standard GWT – based form, or indicating in the more OO way that access to some place should be restricted.

Thanks in advance for any hints

EDIT: I’ve started to wondering if places filtering (restricted/not restricted) should take place on the client side at all. If, as it was suggested, there is a possibility to hack code indicating if user has been authenticated or not, there is also possibility to hack places filtering code, so that it will be possible to access restricted places without signing in.

Answer 1

Piotrek,

I think there is a security issue with calling userHasBeenAuthenticated() – it would be possible to hack the client side code to return true every time this function is called.

The solution I’ve implemented is to simply return SC_UNAUTHORIZED if an unauthenticated user attempts to access any remote service. I’ve overridden the RequestFactory onResponseReceived function which redirects to a login page if the response is SC_UNAUTHORIZED. Idea taken from:
http://code.google.com/p/google-web-toolkit/source/browse/trunk/samples/expenses/src/main/java/com/google/gwt/sample/gaerequest/client/GaeAuthRequestTransport.java

This works for our situation where the Activities and Places are all data-centric – each place change retrieves data from the server. If a user isn’t authenticated they simply don’t get the data and get redirected to a login page.

I realize your situation is slightly different in that some places are accessible to everyone, in which case you could configure only the restricted services to return SC_UNAUTHORIZED.