Wednesday, July 22, 2015

GWT-RPC: hacked attempt on request payload.


My test team try to hack on the system, they found out that GWT-RPC call returned a sensitive information  (class name as highlighted in blue as below) in response format "//EX" message. I'm amazed that I can't find any postings on this issue.

HTTP Request (Request payload):

 HTTP Response:

//EX[2,1,["","This application is out of date, please click the refresh button on your browser. ( Blocked attempt to access
interface 'abc', which is not implemented by 'com.testProject.client.customerClassService'; this is either misconfiguration or a hack attempt)"],0,7]

Specially the part that says "either misconfiguration or a hack attempt". In my case is hack attempt as HTTP Response, because the exception states that 'abc' is not implemented by  'com.testProject.client.customerClassService'.

Any ideas to hide the sensitive information (class name as highlighted in blue) in the error message as above ? I try with all browsers available it is not from the browser. 

Urgent. Any help will be appreciated.

You received this message because you are subscribed to the Google Groups "Google Web Toolkit" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
To post to this group, send email to
Visit this group at
For more options, visit

No comments:

Post a Comment