cyan yelloW maGENTA BLACK panTONE 123 C

Books for professionals by professionals® The EXPERT’s VOIce® in Web Development

Companion eBook Available Covers Pro Web 2.0 Application GWT 1.5 Pro Development with GWT Web 2.0 Dear Reader, This book is for developers who are ready to move beyond small proof-of-concept Pro sample applications and want to look at the issues surrounding a real deploy- ment of GWT. If you want to see what the guts of a full-fledged GWT application look like, this is the book for you. GWT 1.5 is a game-changing technology, but it doesn’t exist in a bubble. Real deployments need to connect to your database, enforce authentication, protect

against security threats, and allow good search engine optimization. To show you all this, we’ll look at the code behind a real, live web site called Application Development with ToCollege.net. This application specializes in helping students who are applying Web 2.0 to colleges; it allows them to manage their application processes and compare the rankings that they give to schools. It’s a slick application that’s ready for you to sign up for and use. Application Development This book will give you a walking tour of this modern Web 2.0 start-up’s code- base. The included source code will provide a functional demonstration of how to merge together the modern Java stack including Hibernate, Spring Security, Spring MVC 2.5, SiteMesh, and FreeMarker. This fully functioning application is better than treasure if you’re a developer trying to wire GWT into a Maven build environment who just wants to see some code that makes it work. If a full tour of 15,000 lines of source code that includes everything from integration with to Acegi Security, OpenID, Lucene full-text searching, and sounds GWT like a good thing, I think you’ll enjoy this book. Yours, Jeff Dwyer Learn real-world, professional GWT techniques by Companion eBook Related Titles following an in-depth case study of a Web 2.0 site.

GWT

See last page for details on $10 eBook version

SOURCE CODE ONLINE ISBN-13: 978-1-59059-985-3 Dwyer www.apress.com ISBN-10: 1-59059-985-3 Jeff Dwyer 5 4 4 9 9

US $44.99 Shelve in Web Development

User level: 9 781590 599853 Intermediate–Advanced

this print for content only—size & color not accurate spine = 0.909" 480 page count

9853FM.qxd 4/15/08 11:14 AM Page i

Pro Web 2.0 Application Development with GWT

Jeff Dwyer 9853FM.qxd 4/15/08 11:14 AM Page ii

Pro Web 2.0 Application Development with GWT Copyright © 2008 by Jeff Dwyer All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. ISBN-13 (pbk): 978-1-59059-985-3 ISBN-10 (pbk): 1-59059-985-3 ISBN-13 (electronic): 978-1-4302-0638-5 ISBN-10 (electronic): 1-4302-0638-1 Printed and bound in the United States of America 9 8 7 6 5 4 3 2 1 Trademarked names may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, we use the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. Java™ and all Java-based marks are trademarks or registered trademarks of Sun Microsystems, Inc., in the US and other countries. Apress, Inc., is not affiliated with Sun Microsystems, Inc., and this book was written without endorsement from Sun Microsystems, Inc. Lead Editors: Steve Anglin, Ben Renow-Clarke Technical Reviewer: Massimo Nardone Editorial Board: Clay Andres, Steve Anglin, Ewan Buckingham, Tony Campbell, Gary Cornell, Jonathan Gennick, Matthew Moodie, Joseph Ottinger, Jeffrey Pepper, Frank Pohlmann, Ben Renow-Clarke, Dominic Shakeshaft, Matt Wade, Tom Welsh Project Manager: Kylie Johnston Copy Editor: Heather Lang Associate Production Director: Kari Brooks-Copony Production Editor: Liz Berry Compositor: Dina Quan Proofreader: Linda Marousek Indexer: Carol Burbo Artist: April Milne Cover Designer: Kurt Krames Manufacturing Director: Tom Debolski Distributed to the book trade worldwide by Springer-Verlag New York, Inc., 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax 201-348-4505, e-mail [email protected], or visit http://www.springeronline.com. For information on translations, please contact Apress directly at 2855 Telegraph Avenue, Suite 600, Berkeley, CA 94705. Phone 510-549-5930, fax 510-549-5939, e-mail [email protected], or visit http://www.apress.com. Apress and friends of ED books may be purchased in bulk for academic, corporate, or promotional use. eBook versions and licenses are also available for most titles. For more information, reference our Special Bulk Sales–eBook Licensing web page at http://www.apress.com/info/bulksales. The information in this book is distributed on an “as is” basis, without warranty. Although every precau- tion has been taken in the preparation of this work, neither the author(s) nor Apress shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work. The source code for this book is available to readers at http://www.apress.com. 9853FM.qxd 4/15/08 11:14 AM Page iii

To those who help me realize it’s easier than we think 9853FM.qxd 4/15/08 11:14 AM Page iv 9853FM.qxd 4/15/08 11:14 AM Page v

Contents at a Glance

About the Author ...... xvii About the Technical Reviewer ...... xix Acknowledgments ...... xxi Introduction ...... xxiii

PART 1 ■ ■ ■ What Can GWT Do for You? ■CHAPTER 1 Why GWT?...... 3 ■CHAPTER 2 Getting Started ...... 17

PART 2 ■ ■ ■ ToCollege.net ■CHAPTER 3 Designing ToCollege.net ...... 47 ■CHAPTER 4 GWT and Spring MVC ...... 63 ■CHAPTER 5 Securing Our Site...... 103 ■CHAPTER 6 Saving Our Work...... 139 ■CHAPTER 7 ToCollege.net’s GWT GUI ...... 181 ■CHAPTER 8 Google Maps ...... 213 ■CHAPTER 9 Suggest Boxes and Full Text Search...... 237 ■CHAPTER 10 Forums...... 265 ■CHAPTER 11 Security and Authorization ...... 307 ■CHAPTER 12 Search Engine Optimization...... 333 ■CHAPTER 13 Google Gears ...... 357 ■APPENDIX Building ToCollege.net ...... 391

■INDEX ...... 427

v 9853FM.qxd 4/15/08 11:14 AM Page vi 9853FM.qxd 4/15/08 11:14 AM Page vii

Contents

About the Author ...... xvii About the Technical Reviewer ...... xix Acknowledgments ...... xxi Introduction ...... xxiii

PART 1 ■ ■ ■ What Can GWT Do for You?

■CHAPTER 1 Why GWT? ...... 3

“May You Live in Interesting Times” ...... 3 To HTML or Not to HTML? ...... 4 So What Is GWT? ...... 5 But JavaScript Is Better Than Java! ...... 6 Speed...... 8 Tools, Tools, Tools ...... 11 JavaScript Libraries...... 12 Community ...... 13 The Rest of the Stack ...... 13 Maven 2...... 14 Summary...... 15

■CHAPTER 2 Getting Started ...... 17

Sample Project Goals ...... 17 GWT Project Structure ...... 18 Client ...... 19 Server ...... 21 Public ...... 22 The GWT Module ...... 23

vii 9853FM.qxd 4/15/08 11:14 AM Page viii

viii ■CONTENTS

Sample Calculator Project Code ...... 24 NumberButton.java ...... 25 ControlButton.java ...... 27 Calculator.java (1) ...... 28 ControlAction.java ...... 29 Calculator.java ...... 30 The EntryPoint Class ...... 35 CalcButton: A CSS Enhancement ...... 36 Animation ...... 38 Code Size ...... 40 The Advantages of Compilation...... 41 Pure Size ...... 42 Summary...... 44

PART 2 ■ ■ ■ ToCollege.net

■CHAPTER 3 Designing ToCollege.net...... 47

User Stories ...... 48 User Story 1: Adding a School ...... 48 User Story 2: Adding Opinions of Schools ...... 48 User Story 3: Sorting Schools into Tiers ...... 48 User Story 4: Viewing Schools on a Map ...... 48 User Story 5: Deciding Among Schools ...... 49 User Story 6: Managing the Application Process ...... 49 What’s Next...... 49 Overview of ToCollege.net ...... 49 My Rankings List ...... 49 My Applications ...... 51 My Decision ...... 52 Maps ...... 53 College Browser...... 53 Forums...... 54 9853FM.qxd 4/15/08 11:14 AM Page ix

■CONTENTS ix

The College.net Domain ...... 55 Using Abstract Property POJOs ...... 55 User and School Objects...... 56 Application Process Objects...... 56 The Process Map ...... 57 Revisiting the User’s List of Schools with a Sorted Map...... 58 Summary...... 61

■CHAPTER 4 GWT and Spring MVC ...... 63

Integrating with a Web Framework ...... 63 Why Use Both? ...... 63 Choosing Spring MVC ...... 64 Templating with FreeMarker ...... 66 The Spring MVC Site ...... 67 Splash! ...... 67 A Quick FreeMarker Tutorial ...... 69 The Dispatcher Servlet ...... 83 Using a Mock for Testing ...... 85 REST-Style URLs in CollegeController.java ...... 86 Basic GWT Integration ...... 90 Putting the Calculator in Spring MVC ...... 91 Modules, Entry Points, and Dictionaries ...... 91 One Module per Component ...... 92 One Module to Rule Them All ...... 92 Passing Information with JavaScript Dictionaries ...... 92 Showing a Loading Message...... 94 ToCollege.Net RPC Integration ...... 95 ToCollegeApp.java ...... 96 Dispatcher Servlet ...... 98 ApplicationContext.java ...... 98 GWTController.java ...... 100 Serialization Policy...... 100 MyPage.java ...... 101 Summary ...... 102 9853FM.qxd 4/15/08 11:14 AM Page x

x ■CONTENTS

■CHAPTER 5 Securing Our Site ...... 103

Acegi Security System ...... 104 Acegi Security Fundamentals ...... 105 Acegi Security and Our Domain ...... 106 Implementing Acegi Security...... 106 Add a Servlet Filter to web.xml ...... 107 Creating the Acegi Security Beans ...... 108 Creating a Login Page in Spring MVC...... 121 Getting the Authenticated User in Code ...... 123 OpenID...... 125 Acegi Security OpenID ...... 126 OpenIDLoginController ...... 127 OpenID Bean Configuration ...... 129 Updating UserDAO ...... 130 Integrating GWT ...... 130 Getting the Current User...... 130 Logging In from GWT ...... 131 Login Service ...... 135 Summary...... 136

■CHAPTER 6 Saving Our Work ...... 139

Adding a Database ...... 139 DAOs and the ToCollege.net Architecture ...... 140 GWT-Specific Persistence Concerns ...... 141 The Command Pattern ...... 142 Building the DAO Layer...... 142 Integrating Hibernate...... 143 Mapping the User Class with User.hbm.xml ...... 148 Application.java and Application.hbm.xml...... 154 SchoolDAO ...... 156 Hibernate and GWT: No DTOs Necessary ...... 157 The Problem ...... 157 Possible Solutions ...... 158 Filter and Go ...... 159 Attaching HibernateFilter to GWT Serialization ...... 162 9853FM.qxd 4/15/08 11:14 AM Page xi

■CONTENTS xi

The Command Pattern, a Powerful Ally...... 164 What Is the Command Pattern?...... 164 How the Command Pattern Works ...... 166 Implementing Commands ...... 167 Testing...... 172 Testing the DAO Layer ...... 173 Testing the Service Layer...... 176 Summary...... 179

■CHAPTER 7 ToCollege.net’s GWT GUI ...... 181

Basic My Page GUI Framework...... 182 Tab Listeners ...... 184 History Management: Repairing the Back Button ...... 185 Functional History and Bookmarking ...... 187 RPC Status Notification...... 187 Step 1: Adding a

Element...... 190 Step 2: Creating a StatusPanel on Bootstrap ...... 190 Step 3: Implement the RPC Notification Strategy (StdAsyncCallback)...... 191 Step 4: Displaying the Status with StatusPanel ...... 193 Step 5: Making It Cool with Fading...... 197 Drag ’n’ Drop ...... 198 DropController and DragController ...... 200 Making Widgets Draggable ...... 202 DragHandler ...... 202 RichTextArea ...... 204 RichTextToolbar’s ImageBundle ...... 206 VerticalLabel...... 209 Summary...... 212

■CHAPTER 8 Google Maps ...... 213

The Mashup Landscape ...... 213 Where We’ll Use Maps in ToCollege.net ...... 214 The Google Maps API and Key ...... 216 9853FM.qxd 4/15/08 11:14 AM Page xii

xii ■CONTENTS

Using the GWT Google APIs ...... 218 Adding to Maven ...... 218 Module Inheritance and Maps JavaScript ...... 218 Geocoding Maps ...... 219 A Simple Bulk Geocoder ...... 219 Updating the My List College Map Tab ...... 223 Creating Another Tab ...... 223 Creating a Map Object ...... 224 Loading Schools...... 225 Making Clickable Markers ...... 226 Why the Dialog Box? ...... 227 Reusable Map Components...... 228 Integrating with Spring MVC ...... 228 The GWT Side of CollegeMap ...... 231 Summary...... 235

■CHAPTER 9 Suggest Boxes and Full Text Search ...... 237

A Basic Suggest Box...... 237 An Ideal Remote Suggest Box ...... 239 Implementing SchoolCompleter ...... 240 Server-Side Suggestion Matching ...... 247 Performance Concerns ...... 247 A Basic, SQL LIKE Implementation ...... 247 Full Text Search Engines ...... 251 Summary...... 264

■CHAPTER 10 Forums...... 265

Designing Forums ...... 266 List of Threads ...... 266 Post Display List...... 267 Reply / Create New Thread ...... 268 History Management and Bookmarkable URLs ...... 269 9853FM.qxd 4/15/08 11:14 AM Page xiii

■CONTENTS xiii

Implementing Forums...... 270 Data Design ...... 270 Forum Page Design ...... 280 Extras...... 298 Summary...... 305

■CHAPTER 11 Security and Authorization ...... 307

Authorization ...... 307 Protecting Our Domain ...... 308 Remembering Security with Our Guilty Consciences ...... 310 Selects ...... 311 Alternative Access ...... 312 GWT Security ...... 313 Cross-Site Scripting (XSS) ...... 313 A Sample XSS Attack ...... 314 GWT’s Inherent Protection ...... 315 Analyzing XSS in RichTextArea ...... 316 Analyzing XSS in FreeMarker...... 316 Analyzing XSS in Spring MVC ...... 317 Securing Ourselves from XSS with Filters ...... 317 Cross-Site Forged Requests (XSRF) ...... 323 Final Security Concerns ...... 330 Data Manipulation ...... 330 Out of Order Requests...... 331 SQL Injections...... 332 Summary...... 332

■CHAPTER 12 Search Engine Optimization...... 333

How Search Works ...... 333 Crawling ...... 334 Indexing...... 334 Serving...... 334 Search Engine Optimization (SEO) ...... 334 and Searching ...... 335 GWT and Searching...... 336 9853FM.qxd 4/15/08 11:14 AM Page xiv

xiv ■CONTENTS

Optimizing ToCollege.net for Indexing ...... 337 Be the Bot: Visualizing Your Site Like a Bot Does ...... 338 Option 1: Secondary Site ...... 340 Option 2: ...... 340 Option 3: Hidden

and