Skip to content
kbrownTW edited this page May 12, 2012 · 4 revisions

Overall Rationale

RelaxFactory delivers an efficient GWT-RIA platform for CDN edge-node and state-full, asynchronous event-based server workloads, with less emphasis on rich declarative annotation driven features and more attention to profiling, performance, and simplicity.

Pure Java NIO webservices

at the core of the RelaxFactory is a web server project called 1xio engineered to provide JDK access to runtime services while keeping the amount of memory used by the server to its thoeretical java minimum heap. static content hosting by 1xio webserver code has been measured at as low as 12 megabytes of java heap usage with a particular build of shared IO buffers. GWT Requestfacotry on a stateless middletier should not increase the overhead significantly, but 1xio overhead to host requestfactory is a fraction of jetty or tomcat servlet based solutions.

CouchDb and K/V stores

couchdb and other key/value stores among them bdb, mongo, and redis can ultimately share a semantically similar pipeline of data with local and memcache storage layers to reduce server traffic and ensure a simple and reliable concurrency model.

this means that a solutions can ultimately be launched with a mix of cached and live data while consolidating RPC based content to a single cache subsumption hierarchy.

GWT+RequestFactory

GWT provides a scalable RIA user interface solution for java programmers with numerous efficiencies built-in.

RequestFactory RPC is extensible and scales up the number of requests sustainable for an application service using ajax request-batching.

Security Patterns

Requestfactory and other RIA platforms wind up providing a wrapper around database calls in js which is unavoidable for delivering browser based data-driven entities proxies and method calls.

the basic approach exemplified in the sample codebase supports:

  1. user arrives with/without cookie.
  2. RF fetches/creates HttpOnly cookie from initial RF request.
  3. RF accesses a couchdb record, created or fetched, with this id. this becomes a session blackboard object callable with non-POJO attributes for individual set/get of json attributes using getSessionProperty/setSessionProperty RF Service Calls with implied session Id.
  4. successive authorized API calls use the implied sessionId from httpOnly cookie.
  5. sending the session EntityId to RF clients opens the door to pathing exploits from js attackers. the above makes this optional.