How to disable rpc token in GWT

Question

I'm using GWT 2.10.0, and I'd like to deactivate the RPC token only during development, but have it activated in production. Any suggestions on how I can achieve this?

Thank you.

Answer 1

It isn't quite clear what you're asking or how you've implemented your own token approach already, so to restate, you have a com.google.gwt.user.client.rpc.RpcToken implementation that can be serialized, and a com.google.gwt.user.server.rpc.XsrfProtect annotation on your RemoteService type. Then you extended XsrfProtectedServiceServlet to provide your server-side implementation of the RemoteService.

XsrfProtectedServiceServlet extends AbstractXsrfProtectedServiceServlet, which extends RemoteServiceServlet itself. RemoteServiceServlet provides an empty method onAfterRequestDeserializedthat can be overridden, andAbstractXsrfProtectedServiceServlet` provides a simple implementation, shared below:

  @Override
  protected void onAfterRequestDeserialized(RPCRequest rpcRequest) {
    if (shouldValidateXsrfToken(rpcRequest.getMethod())) {
      validateXsrfToken(rpcRequest.getRpcToken(), rpcRequest.getMethod());
    }
  }

Then AbstractXsrfProtectedServiceServlet provides a simple protected implementation of shouldValidateXsrfToken, but leaves validateXsrfToken abstract, so that your superclass, XsrfProtectedServiceServlet, can override it. Both of these seem like a reasonable extension point to provide custom functionality - you can override either method, and if you determine you are running in production, call super, otherwise if you are in development/test, ignore the rest of the check and simply return success.

For example, assuming you have a isRunningInProduction() method (up to you to implement, either of these should solve your problem:

  @Override
  protected boolean shouldValidateXsrfToken(Method method) {
    if (isRunningInProduction()) {
      super.shouldValidateXsrfToken(method);
    }
    // not in production, skip validation
    return false;
  }

or

  @Override
  protected void validateXsrfToken(RpcToken token, Method method)
      throws RpcTokenException {
    if (isRunningInProduction()) {
      super.validateXsrfToken(token, method);
    }
    // not in production, do nothing
  }

Note that providing both will also work, but only shouldValidateXsrfToken will ever be called.