App Engine Security Constraint

Question

I am building a small app engine project connected to Android and Iphone devices. I want only the users who has the Google account has to access my http://myuser.appspot.com... Whenever they post something, I want to grab their gmail id and associate with the message that they post using http://myuser.appspot.com... I dont want some one to post junk messages though I perform a validation, but still I want to collect the gmail user id for further reference. I tried adding this web.xml, but it is not forcing me to enter my gmail id before the page shows up,

<security-constraint>
    <web-resource-collection>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
</security-constraint>

Thanks, Ramesh

did you made a logout on gmail before accessing your app ? – fmt.Println.MKO Jun 28 '13 at 17:40 — fmt.Println.MKO, Jun 28 '13 at 17:40

score 0 · Answer 1 · answered Jun 28 '13 at 17:44

0

That configuration looks like it should be fine.

Are you already logged into Google? If so it should just pick up the authentication automatically, and you won't need to login again. Try logging out, and then visiting the page.

answered Jun 28 '13 at 17:44

Robert Parker

605
4
7

Hello Robert, I am facing issues once I added this code /* * in web.xml... If I dont have this code, then it fetches the device list and show it on UI. If I have this code, its say fetching device list and spinning cursor on the browser goes on forever... any idea? – Ramesh Sangili Jul 01 '13 at 21:20

score 0 · Answer 2 · answered Jul 11 '13 at 21:48

I found workaround for this issue, that may not be the right way, but I tried all possible ways and came to this conclusion, instead of doing auth constraint for all pages, wheenver I do for the first page, then it always fails to connect.

<security-constraint>
    <web-resource-collection>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
</security-constraint>

I am doing for specific pages, and redirect to the first page after it gets authenticated onLoad on my second page.

If you find any better solution, please do post.

App Engine Security Constraint

2 Answers2