search

aesteve / nubes

Annotation layer on top of Vert.x 3
Apache License 2.0
120 stars 35 forks source link

eventbus and services #34

Closed ldallen closed 9 years ago

ldallen commented 9 years ago

Hi ! I'm trying to build some small examples with nubes, and I would like to be able to communicate with a client through the eventbus. I just created an echo service which reply every message received at "service.echo" address on the eventbus, and I tried to send a message to the same address on the client side, but it's not working.. In fact, the message sent by the client is received correctly by the SockJSController, but the service never receive it. Is it something not implemented yet, or did I forget to add some configuration ?

L-M

aesteve commented 9 years ago

Hi L-M :)

First, what do you mean by "client", a Javascript client accessing the eventbus through the browser ?

In this case no, it's not implemented yet unfortunately, I'm working on it.

Vert.x provides an event bus bridge to be accessed by Javascript clients.

I wanted to add an @EventBusBridge annotation on top of SockJS controllers, but the problem is security.

Before you're forwarding messages to clients, you need to check they can access the info sent over the eventbus, or it would be a massive security gap.

Vert.x does that with the notion of permitted options which is a programmatic API, very difficult to convert into an Annotation.

Maybe I could just add an @EventBusBridge annotation which exposes everything and mention that's it's a massive security hole, idk, ....

If you're not referring to a Javascript client but another Vert.x client, then please show me some code so that I can figure out what's wrong.

Thanks for the question.

ldallen commented 9 years ago

Thanks for your quick answer! :-)

Yes I'm using a js client, so that's why it's not working... Ok now I see why it has not been implemented yet! I developped a vertx-web app using the eventbus, and I think it would be great to have some equivalent to the permitted options, even though it seems not to be easy to do... I will think about it, if I find a solution I would be happy to help you!

Otherwise, when you use Vertx-web cookies without https, they send us this warning : "Using session cookies without https could make you susceptible to session hijacking", so you could maybe send some similar warning to mention that it's a "massive security hole" as you said...

aesteve commented 9 years ago

See #35