How clients communicate with the Storage Service

There are two ways to communicate with the storage service:

This page discusses:

See Also
Creating Collaborative Widgets Using Storage Service
Storage type scopes
Common operations

The Java client communicates directly with the service at: http://<HOSTNAME>:<BASEPORT+10>/storage-service

The Javascript client communicates with the service through the storage proxy at: http://<HOSTNAME>:<BASEPORT>/mashup-ui/storage

The Javascript client is meant to communicate through the proxy for the 3 following reasons:

  • The XHR requests issued by the Javascript client is subject to the cross-domain restrictions that apply to all XHR requests. Therefore, a proxy on the same port/domain is necessary.

  • The proxy has rudimentary XSRF protection (X-Requested-With header checking) for the Javascript client's calls, preventing a user X to make changes to the state of user Y's data using XSRF.

  • The USER scope. The proxy automatically appends the login name of the user who is currently logged in to the outgoing requests. When communicating directly with the storage service, the user needs to supply the user token manually.