GWT RPC 数据格式

发布于 2024-11-09 23:18:31 字数 154 浏览 2 评论 0原文

Google Web Toolkits (GWT) RPC 调用的数据格式如何以及 IsSerialized 对象如何传输。我知道 Java Serialized 传输某种二进制格式,但是 GWT 也是这种情况吗? (因为我不期望它与 JavaScript 兼容,或者至少需要一些额外的解析)。

How does the data format for Google Web Toolkits (GWT) RPC calls look and how are IsSerializable objects transmitted. I know that Java Serializable transmits some kind of binary format, but is this the case with GWT too? (Since I don't expect it to be compatible with JavaScript, or at least require some additional parsing).

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

熟人话多 2024-11-16 23:18:31

编辑: Brian Slesinsky 刚刚记录了该协议(通过对代码进行逆向工程):https://docs.google.com/document/d/1eG0YocsYYbNAtivkLtcaiEE5IOF5u4LUol8-LL0TIKU/edit

首先,GWT -RPC协议是不对称的,因此它总是针对客户端:快速反序列化来自服务器的内容,并快速序列化发送给服务器的内容。

正如您所怀疑的,它显然不是二进制的,而是基于文本的。客户端到服务器协议是管道分隔的,而服务器到客户端基于 JSON(带有 //OK//EX 前缀来判断请求是否成功或失败)。两者都使用可序列化类的常识来进行序列化/反序列化;例如,双方都知道类 X 有两个字段,一个整数和一个字符串,按该顺序序列化,因此它们都写入/读取一个整数,然后是一个字符串,无需在编码格式中指定它是哪个字段关于。

GWT-RPC 协议是版本化的(随着新 GWT 版本的发布,它会定期更改),并使用类的哈希值和可序列化字段名称来确保客户端和服务器都使用相同版本的类(这意味着您必须重新编译并在每次更改可序列化类时重新部署客户端代码)。

最好的文档是代码,但您可以在这些幻灯片中找到请求格式的概述:https: //www.owasp.org/images/7/77/Attacking_Google_Web_Toolkit.ppt

RequestFactory与GWT-RPC相反,使用基于对称JSON的协议(基于AutoBean 的 JSON 序列化),即使不是从相同的代码编译时,客户端和服务器也可以进行通信(当然,这取决于您在版本之间所做的更改),因为它们传递类和属性名称。

EDIT: Brian Slesinsky just documented the protocol (by reverse-engineering the code): https://docs.google.com/document/d/1eG0YocsYYbNAtivkLtcaiEE5IOF5u4LUol8-LL0TIKU/edit

First, GWT-RPC protocol is asymmetric so that it's always optimized for the client-side: fast to deserialize something coming from the server, and fast to serialize something to send to it.

It's obviously not binary, as you suspected, but text-based. client-to-server protocol is pipe-delimited while server-to-client is based on JSON (with a //OK or //EX prefix to tell whether the request succeeded or failed). Both use the common knowledge of the serializable classes to serialize/deserialize; for instance, both sides know that class X has two fields, an integer and a String, serialized in that order, so they both write/read an integer, and then a String, with no need to specify in the encoded format which field it's about.

GWT-RPC protocol is versionned (it changes regularly as new GWT versions are released), and uses hashes of the class and serializable fields' names to ensure the client and server both use the same versions of the classes (which means you have to recompile and redeploy your client code each time you change a serializable class).

The best documentation is the code, but you'll find an overview of the request format in these slides: https://www.owasp.org/images/7/77/Attacking_Google_Web_Toolkit.ppt

RequestFactory, contrary to GWT-RPC, uses a symmetric JSON-based protocol (based on AutoBean's JSON serialization) where client and server can communicate even when not compiled from the same code (well, depending on the changes you made between versions, of course), because they pass around class and property names.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文