After days without any progess, I need your help.
With GWT, I'm trying to communicate with my REST server, the server is on a different URL (CORS needed).
My configuration:
Server
- spring-boot 1.3.3
Client
- GWT 1.7
- restygwt 2.0.3
Server side, I think it's ok.
When I disable the security in Spring, I can get datas in my GWT client.
But when I enable it, I always get 401 requests. The REST URL request works directly in the web browser (with its authentication dialog).
Client side, I have followed this page:
https://ronanquillevere.github.io/2014/04/11/restygwt-basic-auth.html
Here is my code:
The filter which adds credentials in the header
public class BasicAuthHeaderDispatcherFilter implements DispatcherFilter {
public static final String AUTHORIZATION_HEADER = "Authorization";
@Override
public boolean filter(Method method, RequestBuilder builder) {
try {
String basicAuthHeaderValue = createBasicAuthHeader(
UserCredentials.INSTANCE.getUserName(),
UserCredentials.INSTANCE.getPassword());
builder.setHeader(AUTHORIZATION_HEADER, basicAuthHeaderValue);
} catch (UnsupportedEncodingException e) {
return false;
}
return true;
}
private String createBasicAuthHeader(String userName, String password)
throws UnsupportedEncodingException {
String credentials = userName + ":" + password;
String encodedCredentials = new String(Base64.encode(credentials
.getBytes()), "UTF-8");
GWT.log("encodedCredentials=["+encodedCredentials+"]");
return " Basic " + encodedCredentials;
}
}
The dispacher:
public class MyDispatcher extends DefaultFilterawareDispatcher {
public MyDispatcher() {
addFilter(new BasicAuthHeaderDispatcherFilter());
}
}
And my test call:
@Override
public void onClick(ClickEvent event) {
Defaults.setDispatcher(new MyDispatcher());
UserCredentials.INSTANCE.setUserName("user");
UserCredentials.INSTANCE.setPassword("psswd");
String url = "http://localhost:8080/race";
Resource resource = new Resource(url);
resource.get().send(new JsonCallback() {
@Override
public void onSuccess(Method method, JSONValue response) {
GWT.log(response.toString());
}
@Override
public void onFailure(Method method, Throwable exception) {
GWT.log("Erreur: ", exception);
}
});
}
And now the resulting headers in web browser dev tools.
Directly in the web browser:
Request
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding gzip, deflate
Accept-Language fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Authorization Basic R3V5OnR5Y29vbg==
Cache-Control max-age=0
Connection keep-alive
Host localhost:8080
User-Agent Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0
Answer
Cache-Control no-cache, no-store, max-age=0, must-revalidate
Content-Type application/json;charset=UTF-8
Date Thu, 28 Apr 2016 17:35:31 GMT
Expires 0
Pragma no-cache
Server Apache-Coyote/1.1
Set-Cookie JSESSIONID=A496281DBD6E9B797887B9C34B47DA52; Path=/; HttpOnly
Transfer-Encoding chunked
X-Frame-Options DENY
X-XSS-Protection 1; mode=block
x-content-type-options nosniff
GWT Client
Request
Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding gzip, deflate
Accept-Language fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Access-Control-Request-He... authorization,x-http-method-override
Access-Control-Request-Me... GET
Connection keep-alive
Host localhost:8080
Origin http://127.0.0.1:8888
User-Agent Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0
Answer
Access-Control-Allow-Cred... true
Access-Control-Allow-Orig... http://127.0.0.1:8888
Allow GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
Cache-Control no-cache, no-store, max-age=0, must-revalidate
Content-Length 0
Date Thu, 28 Apr 2016 17:43:29 GMT
Expires 0
Pragma no-cache
Server Apache-Coyote/1.1
Set-Cookie JSESSIONID=4D80D0C0FA9E27D166F6489CC88C3E45; Path=/; HttpOnly
Vary Origin
WWW-Authenticate Basic realm="Realm"
X-Frame-Options DENY
X-XSS-Protection 1; mode=block
access-control-allow-head... authorization, x-http-method-override
access-control-allow-meth... GET
x-content-type-options nosniff
I have noticed 2 things:
- In the gwt header request, I do not have the Authorization value. However in the console log, I have a trace which confirm that my filter is triggered.
- Only with firefox, when I do my request, firebug catches 2 network paquets, the first has the Authorization value but no answer, the 2nd one is the results I decscribed above.
Thanks for your help.
Solved.
My server rejects the pre-flight request submitted by the web browser.
I add a CorsFilter in my server, it's ignoring OPTIONS request
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletResponse theResponse = (HttpServletResponse) response;
HttpServletRequest theRequest = (HttpServletRequest) request;
theResponse.setHeader("Access-Control-Allow-Origin", theRequest.getHeader("Origin"));
if ("OPTIONS".equalsIgnoreCase(theRequest.getMethod())) {
theResponse.setHeader("Access-Control-Allow-Credentials", "true");
theResponse.setHeader("Access-Control-Allow-Methods", "POST, GET, HEAD, OPTIONS, DELETE");
theResponse.setHeader("Access-Control-Allow-Headers", "Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization, X-HTTP-Method-Override");
}else{
chain.doFilter(request, response);
}
}