Session Management in GWT

In most applications we usually have a login page. That’s fairly simple to implement in GWT. Maintaining state after the login is not straightforward. Here’s how we achieve that in a typical GWT application.

Firstly, declare the Service methods that are available to Client.

@RemoteServiceRelativePath("LoginService")
public interface LoginService extends RemoteService
{
	/**
	 * Utility class for simplifying access to the instance of async service.
	 */
	public static class Util
	{
		private static LoginServiceAsync instance;

		public static LoginServiceAsync getInstance()
		{
			if (instance == null)
			{
				instance = GWT.create(LoginService.class);
			}
			return instance;
		}
	}

	UserDTO loginServer(String name, String password);

	UserDTO loginFromSessionServer();
	
	boolean changePassword(String name, String newPassword);

	void logout();
}

Implementation of the server side support for supporting this behaviour is as follows:

public class LoginServiceImpl extends RemoteServiceServlet implements LoginService
{
	private static final long serialVersionUID = 4456105400553118785L;

	@Override
	public UserDTO loginServer(String name, String password)
	{
                //validate username and password
                
                //store the user/session id
		storeUserInSession(user);

		return user;
	}

	@Override
	public UserDTO loginFromSessionServer()
	{
		return getUserAlreadyFromSession();
	}

	@Override
	public void logout()
	{
		deleteUserFromSession();
	}

	@Override
	public boolean changePassword(String name, String newPassword)
	{
		// change password logic
	}

	private UserDTO getUserAlreadyFromSession()
	{
		UserDTO user = null;
		HttpServletRequest httpServletRequest = this.getThreadLocalRequest();
		HttpSession session = httpServletRequest.getSession();
		Object userObj = session.getAttribute("user");
		if (userObj != null && userObj instanceof UserDTO)
		{
			user = (UserDTO) userObj;
		}
		return user;
	}

	private void storeUserInSession(UserDTO user)
	{
		HttpServletRequest httpServletRequest = this.getThreadLocalRequest();
		HttpSession session = httpServletRequest.getSession(true);
		session.setAttribute("user", user);
	}

	private void deleteUserFromSession()
	{
		HttpServletRequest httpServletRequest = this.getThreadLocalRequest();
		HttpSession session = httpServletRequest.getSession();
		session.removeAttribute("user");
	}

}

FInally, on the client clicking on the login button. we do the following:

LoginService.Util.getInstance().loginServer(txtfldUserName.getValue(), txtfldPassword.getValue(), new AsyncCallback<UserDTO>()
				{
					@Override
					public void onSuccess(UserDTO result)
					{
						if (result.getLoggedIn())
						{
							RootPanel.get().clear();
							// load the next app page


                                                        //set session cookie for 1 day expiry.
							String sessionID = result.getSessionId();
							final long DURATION = 1000 * 60 * 60 * 24 * 1;
							Date expires = new Date(System.currentTimeMillis() + DURATION);
							Cookies.setCookie("sid", sessionID, expires, null, "/", false);
						} else
						{
							Window.alert("Access Denied. Check your user-name and password.");
						}

					}

					@Override
					public void onFailure(Throwable caught)
					{
						Window.alert("Access Denied. Check your user-name and password.");
					}
				});

Most important validation to determine if session is still valid and appropriately redirect to the app page or directly to the login page back again. So, on the module load do these checks.

        public void onModuleLoad()
	{
		String sessionID = Cookies.getCookie("sid");
		if (sessionID == null)
		{
			displayLoginWindow();
		} else
		{
			checkWithServerIfSessionIdIsStillLegal();
		}
	}

        private void checkWithServerIfSessionIdIsStillLegal(String sessionID)
	{
		LoginService.Util.getInstance().loginFromSessionServer(new AsyncCallback<UserDTO>()
		{
			@Override
			public void onFailure(Throwable caught)
			{
				displayLoginWindow();
			}

			@Override
			public void onSuccess(UserDTO result)
			{
				if (result == null)
				{
					displayLoginWindow();
				} else
				{
					if (result.getLoggedIn())
					{
						IndexPage w = new IndexPage(result.getName());
						RootPanel.get().add(w);
					} else
					{
						displayLoginWindow();
					}
				}
			}

		});
	}

Do, drop in your comments. Hope it was useful.