CODEWITHSUNDEEP
google-app-enginego
Dijkstra
Dijkstra

Reputation: 2530

Program access admin on GAE - oauth2

I have a GAE app, with a URL I restrict to admin:

- url: /admin
  script: _go_app
  login: admin

I want to PUT or POST to this url with another Go program. What code do I need to write for the client to authenticate to GAE and dev_server.py? Is there a more sensible way that just mocking a web-browser and logging in? I don't need to authenticate or authorise other users, just the admin account for that app.

Is this OAuth? OAuth2? OpenID? Federated? Something else?

I realise this is a bit of an awkward question, since I'm not even sure what the right way to ask it is. However I am able to post to (in this example) /admin using a web browser after logging in with my (admin) gmail account. In that case the request (sent by Chrome) contains the cookies: __cfduid, ACSID (and what I think are Google Analytics IDs). Presumably one of those is responsible for my authentication. How do I get one of those?

And as a side question, if someone MITMs my connection (over http), can they hijack my admin session by reusing that cookie?

Upvotes: 1

Views: 316

Answers (2)

Intermernet
Intermernet

Reputation: 19388

GAE likes OAuth2

Have a look at goauth2 . It seems to be the canonical OAuth2 library for Go. They provide a fairly comprehensive example at https://code.google.com/p/goauth2/source/browse/oauth/example/oauthreq.go .

With regards to your question "Presumably one of those is responsible for my authentication. How do I get one of those?", they state:

To obtain Client ID and Secret, see the "OAuth 2 Credentials" section under the "API Access" tab on this page: https://code.google.com/apis/console/

And, finally, my humble opinion on "if someone MITMs my connection (over http), can they hijack my admin session by reusing that cookie?" is that you should never provide any authenticated connection (nor the connection that does the authentication) over plain http. Especially an admin section.

EDIT: To elaborate on the MITM question, make sure you use HTTPS for any login requests and subsequent requests for the same session, and make sure to set Secure and HttpOnly flags on your cookies.

Upvotes: 2

elithrar
elithrar

Reputation: 24260

OAuth2 if you want to use Google Accounts.

See here for details: https://developers.google.com/appengine/docs/go/users/overview (this section specifically deals with admin views)

Upvotes: 0

Related Questions