CODEWITHSUNDEEP
oauth-2.0google-cloud-storage
tak3shi
tak3shi

Reputation: 2405

Storing and accessing private data

My goal is to offer a service for user of my website to store their private notes. I want that users can trust the service, therefore the data should not be accessible for my company.

Can i realize this with google-cloud-storage and oauth-2.0 authentication? I would use the Google Cloud Storage JSON API to send the notes directly from the browser into the cloud.

What would be the basic steps to implement this?

Upvotes: 1

Views: 142

Answers (1)

Brandon Yarbrough
Brandon Yarbrough

Reputation: 38379

There are a couple of ways to handle this, depending on how you want to handle authentication. If you want to make sure that your application cannot access the objects and only the users can, you'll need the users to have Google accounts and authenticate your app to act as their agent using OAuth 2.

Your app could involve a piece of JavaScript that would prompt the user to authenticate with Google and grant it access to Google Cloud Storage under their name. It would then receive a token that it could use to act as them. From there, it would upload the note using that token with an ACL granting permissions only to the uploader.

The uploaded object would go into your bucket, but it would be owned by the end user. You'd have the ability to delete it, but not to read it, and your bucket would be billed for storage and access.

The downside here is that all of your users would need to have Google accounts that they could entrust to your application for short periods of time.

Here are some details on the OAuth 2 exchange: https://developers.google.com/accounts/docs/OAuth2UserAgent

Here's the JavaScript client that does a lot of the authorization heavy lifting for you: https://code.google.com/p/google-api-javascript-client/

And an example of using that library for authorization: https://developers.google.com/api-client-library/javascript/samples/samples#AuthorizingandMakingAuthorizedRequests

Another alternative would be for the user to upload directly to the cloud using YOUR credentials via signed URLs, but if you went down this road, you would be able to read the notes after they were uploaded.

Upvotes: 1

Related Questions