Security when using GWT RPC
- by gerdemb
I have an POJO in Google Web Toolkit like this that I can retrieve from the server.
class Person implements Serializable {
String name;
Date creationDate;
}
When the client makes changes, I save it back to the server using the GWT RemoteServiceServlet like this:
rpcService.saveObject(myPerson,...)
The problem is that the user shouldn't be able to change the creationDate. Since the RPC method is really just a HTTP POST to the server, it would be possible to modify the creationDate by changing the POST request.
A simple solution would be to create a series of RPC functions like changeName(String newName), etc., but with a class with many fields would require many methods for each field, and would be inefficient to change many fields at once.
I like the simplicity of having a single POJO that I can use on both the server and GWT client, but need a way to do it securely. Any ideas?
