Will ClientBundle work when I allow people to embed my app in their site?

[Carsten]

Hi,

I plan to use ClientBundle to load resources into my GWT app. Once the app is finished I plan to allow people to embed the app (reference the js-file located on my server that will load everything else).

I wondered if the resource loading will automagically keep working in spite of the Same Origin Problem? If it doesn't work, what else should I use?

[Joseph Lust]

Carsten,

I've not done this myself, but loading image, js, and text files should not be a problem since SOP only limits XHR requests. However, if they have an HTTPS site, and your content is not served from such a domain, they would get warnings.

Of course, you'd best setup a testbed to confirm this functionality before building it out.

Sincerely,

Joseph

[Carsten]

I was talking about ClientBundle, which means resources not embedded in and loaded by the website but dynamically loaded by the GWT app at runtime. ClientBundle has to use some mechanismn inside like XHR or JSONP or something when it turns data into ExternalTextResources or DataResources.

I know the app will work if people take everything (the HTML host page, the full app and all the ClientBundle resources) and place them on their server. However I am interested in the case that people will embed just the bootstrap-JS file in their webpage. I know that apps fully work this way. What I have no experience in is if this app will work if it uses ClientBundle to load additional resources from app code.

One would think ClientBundle JavaDocs would have a big warning that it fails if used this way, right?

[Jens]

CssResource: works as its inlined into your JavaScript to avoid round trip times.

ImageResource: should work as you typically use it with GWT's @Sprite in CSS or in combination with GWT's Image class. In both cases the image will be loaded via CSS background-image: url(<imageUrl>) => no SOP.

DataResource: With DataResource you only have DataResource.getUrl() to access it. So it depends on yourself and how you load the url. If you load it via XHR you have a SOP problem. But if its for example a custom mouse cursor and you set the url to CSS cursor:url(<url>) its not a problem.

TextResource: Are inlined into your JS and should work, but there is a max limit in text size (see: TextResourceGenerator.MAX_STRING_CHUNK and its JavaDoc).

ExternalTextResource: Are loaded async (XHR) and wouldn't work but it seems like there is a configuration property that tells GWT to load the ExternalTextResource via JSONP (see: ExternalTextResourceGenerator.USE_JSONP and its JavaDoc). So you would use <set-configuration-property name="ExternalTextResource.useJsonp" value="true" /> in your module.gwt.xml.

Also you should be able to test all this very easily by creating a mini project only containing a ClientBundle and some code which uses it, compile it and load it from a different domain. E.g. serve it from localhost and access it from 127.0.0.1 or edit your systems hosts file and add some more domain names for your local host, e.g. 127.0.0.1 localhost test-domain1.com test-domain2.com.

-- J.

[Carsten]

Thanks. Very helpful. From what I am reading I guess the ExternalTextResource cannot switch to JSONP at runtime? I can test at runtime if the HTML host page domain is different from the Module domain and activate it at runtime.

Maybe I will use ExternalTextResource then. I need to check first if it bundles all ExternalTextResource resources in a single file which I wouldn't like. Maybe I remember it incorrectly and it was TextResource which does the bundling.

[Jens]

From what I am reading I guess the ExternalTextResource cannot switch to JSONP at runtime?

Correct, you can not switch at runtime because different code is generated during compilation based on the mentioned configuration property. 

-- J.