Reputation: 58632
Recently when I have been handshaking(oauth flow) with facecbook, when the callback returns google is sending it to : http://<version>-dot-<app_id>.appspot.com
I send out a callback in the form https://<app_id>.appspot.com/bah/facebook_callback
and it comes back as http://<version>-dot-<app_id>.appspot.com/bah/facebook_callback
Previously it was working fine, no code changes what so ever.. is this SDK 1.6.6 related?
Does anyone know why, or can explain to me how to not allow this to happen ?
Upvotes: 0
Views: 151
Reputation: 80350
GAE actually maps this Urls to the same instance: http://<version>-dot-<app_id>.appspot.com
maps same way as http://<version>.<app_id>.appspot.com
This is being done to work around some browser limitation on wildcard SSL certificates: certificate for *.domain.com
will not be allowed by browsers for domain *.*.domain.com
So Google maps *.*
to *-dot-*
as a workaround and uses alternative notation during QAuth process.
See this: https://developers.google.com/appengine/docs/java/config/webxml#Secure_URLs
And this: Wildcard subdomains on appengine over https on firefox
Upvotes: 1