gwt rpc - Encode request payload in GWT RPC call -

i using gwt create web-app.

when making rpc call client side (browser), in inspect element request payload below :

7|0|8|https://xxxx.xxxx.in/testproject/in.testproject.main/|87545f2996a876761a0c13cd750ea654|in.testproject.client.customerclassservice|check_user_login|java.lang.string/2004016611|in.testproject.beans.customerbean/3980370781|userid|password|1|2|3|4|3|5|5|6|7|8|6|0|0|0|0|0|custid|0|0|0|0|0|0|0|0|0| 

in request details username, password & custid displayed in request payload.

my question is, possible encode or hide details request payload?

you looking @ wrong level of abstraction. what's point of encoding/"hidding" these values in payload? exchange between server , client can intercepted anyway... unless use https. ensures safe/encrypted communication between server , client. don't try "clever" , encrypt part of communication/payload, just use https.

but concern client should not able seen method call making, parameter type in request, parameter values etc. should hidden client.

but parameter values input user himself or hardcoded somewhere in application (which user able see/decipher, because browser has to). trying achieve security through obscurity , never idea. i'd focus attention , efforts securing endpoints (gwt-rpc services), validating input sent there, etc.

you have remember 1 thing - user has access source code (compiled , minified, still) of client-side part of application. so:

• he'll able figure out how communicate server, because application has to.
• he can modify application send malicious requests - if created hypothetical way of encoding parameters/addresses. find place before encoding done , voila. firebug , other developer tools immensely in this.

so "securing" client-side in way meaningless (of course, csrf, xss, etc. should concern), malicious user bypass because have give him tools - otherwise, "normal" user (or rather browser) wouldn't able use application.