gwt - 在生产中包含 devModeRedirectEnabled=true 的缺点？

Question

我今天成功运行了 GWT 2.6.1 SuperDevMode，我想知道我们是否可以将这一行留在 .gwt.xml 文件中:

<set-configuration-property name="devModeRedirectEnabled" value="true"/>

在本文 ( http://blog.ltgt.net/how-does-gwts-super-dev-mode-work/ ) 中，它建议将其删除以用于生产。我想知道为什么？

如果我们将其保留用于生产，会对性能或安全产生任何影响吗？

Answer 1

实际上，从 GWT 2.6.0 开始，它现在开启，因为已经添加了安全措施。

来自release notes :

Release Notes for 2.6.0 (RC4)

This release enabled the Super Dev Mode hook by default

[…]

Super Dev Mode

• Security: with 2.6 we believe it's safe to turn on the Super Dev Mode hook and leave it on in production. As an extra precaution, we recommend setting the devModeUrlWhitelistRegexp configuration property to ensure that it can only load JavaScript from localhost and your developers' machines in your own domain.

• Security: automatically disable Super Dev Mode on https pages (Another precaution, and it doesn't work anyway due to mixed-content restrictions.)

(注意:devModeUrlWhitelistRegexp 默认只允许 localhost 和 127.0.0.1)