Google Web Toolkit -- adapting pains and issues

I have been first exposed to GWT on November 2006 and in one of our Java User group meeting. At that time we are looking to replace our ancient applet based web application. I saw the similarities on how GWT is similar to Java Swing in some of its components. Surely enough our group adapted and went with GWT. Here are the major issues that we have encountered.

The issues are based on some wrong assumptions about GWT.
Here is some points that our team missed about GWT.
- GWT is JavaScript
- JavaScript is executed in the clients Browser
- GWT is not a web application framework
- Be Aware of GWT Security issues

GWT is JavaScript
Even though GWT is coded using Java and leverages Java Tools, at the end of the day it is still JavaScript. So it is subjected to JavaScript issues like the following:
- Threading - JavaScript is event driven and has single threaded model for development. So codes that are executed will be solely based on events.
- Code size - even though there is no limit on how big your JavaScript could be. JavaScript is downloaded to the users browser before executing so the bigger your JavaScript code the longer it will take to download. (Our new application would eat up around 4 MB before you can use it)
- Browser Caching - The browser will cache JavaScript codes, so any production update will be totally dependent on a users browser cache settings. When deploying GWT, one must have a caching strategy on what is kept on the client side and how it is affected by updates on the server.
The only consolation that I can think of for GWT being java Script is that as a Java developer I don’t worry about coding in Java Script because it is done by GWT but I have to trust Google to provide me with a defect free tool and the people working on GWT must be very talented Java Script developers.

JavaScript is executed in the Client's Browser
GWT provides a strong support for browser compatibility .But, browsers today gives a lot of freedom to the users. Any application that uses the browser as an application platform will be subjected to a user’s browser settings One should be able to understand the limitations of the browser as an application platform specially if your code (like JavaScript) is executed in a client’s browser. With this in mind you should keep as much on the server as possible so that the client will deal with little or as minimal of the presentation or UI as possible.

GWT is not a web application framework
You should not approach GWT as a web framework but rather as a User Interface library with Asynchronous call support much like Yahoo UI. This will change your perspective on how to build your codes and how you determine interfaces between the GWT UI presentation and server

Be Aware of GWT Security issues
One last thing you don’t want to happen to your web application to leak sensitive data. When developing GWT make sure that a good security testing strategy is included . Even though GWT might have done a good job preventing some exploits, AJAX in general increases the surface for malicious attack for a web application. I just recently was able to do an exploit on our web application using Cross Site Scripting that we should now consider upgrading our GWT version.

Comments

Post a Comment

Popular posts from this blog

OAuth 1.0a Request Signing and Verification - HMAC-SHA1 - HMAC-SHA256

Image
This is a security project that I did this Fall semester. I was interested in why the OAuth1.0a specification did not require you to sign a request using RSA-SHA1 or any RSA algorithm. The first issue that I found is where would you store your private keys in a javascript client? - as a javascript encrypted file ? from the browser ?  - that will be a security hole if you allow javascript to get private keys. These are some of the questions that got me asking and which I cannot find answers to for now. OAuth 1.0a Signature Signing and Verification using JavaScript Implementation Background The OAuth specification tries to define an API authentication method that allows consumer websites or applications to access protected API Resources from a Service provider. The advantage that OAuth provides is that the user of the website or application is not required to disclose their credentials to their service provider. Another advantage of using OAuth to authenticate is that it does not
Read more

Spark DataFrame - Array[ByteBuffer] - IllegalAurmentException

IllegalArgumentException - ByteBuffer - Spark DataFrame I was processing a several million documents (~ 20 million) in which we need to extract the NLP features using NLP4J, OpenNLP, and WordNet. The combination of the three NL features blows up each record to 11 times its original size. We are using all three because we do not know yet what feature sets will be helpful to us. The original dataset is in parquet files in HDFS (16 partitions). I thought that was convenient just use withColumn and pass a UDF (User Defined Function) on the column where it needs those features. withColumn adds the calculated column back to the DataFrame. So I created the spark job (I am on Spark 1.5.2-cdh5.5.2)for the above, and things started to get nasty. I am blowing up the ByteBuffer array on the in-memory columnar storage. This is the exception that I am getting. There seems to be no reference in my code in this stack trace. java.lang.IllegalArgumentException at java.nio.ByteB
Read more

Gensim Doc2Vec on Spark - a quest to get the right Vector

Ever since I joined the R & D group we have been doing a lot of cool things, like trying IBM Watson (see previous blog entry). Now we are doing a lot of Natural language processing.  We wanted to compare the similarity of two documents. There is this excellent project Gensim ( doc2vec ) that easily allow to you to translate large blocks of text to a fixed length feature vector to make comparisons. Here is the link to the  original paper  from some people from Google that explains the approach. In essence, they wanted to find a representation that will overcome the weaknesses of the bag of words model. The doc2vec approach proves to be a reliable approach to comparing similarities of documents because it takes into consideration the semantics and the order of the word in context. So with that, we wanted to use it for a corpus of 26 million documents. Calculating the doc2vec for 26 million documents is not a small task, so we need to process it in Spark. The problem is that there
Read more