CODEWITHSUNDEEP
securitygoogle-app-engineencryption
jchitel
jchitel

Reputation: 3169

Google App Engine good way to send and store passwords

I am getting to the point in my Google App Engine development where I am signing users up. I collect the signup info, do some initial validation to make sure that things are the correct length/format, then send that info to the App Engine for server side validation and ultimately signup and login. I understand that I can think of the App Engine as extremely secure (it's Google anyway) and my client side is a Cordova application, which is also secure because it is wrapped in an app package. The only insecure part of the interaction is the HTTP POST request that I send containing the password. I see really only one option for making this more secure. I may be right, I may be wrong. I honestly have no idea.

I'm thinking that I could encrypt the password locally and decrypt it once it hits the app engine. The problem with this is that anyone monitoring my requests can read this decrypted value and they don't even need to decrypt it. They can just send it encrypted as it is. I can adjust this by making the encryption dependent on other variables that only the app engine knows about, but I'm not sure if that is a good way either.

I know next to nothing about web security, and very little about encryption techniques. What is the best way to send and store passwords with Google App Engine?

Upvotes: 2

Views: 722

Answers (2)

Gwyn Howell
Gwyn Howell

Reputation: 5424

Send over HTTPS - App Engine provides SSL for free - USE IT! Then at the server encrypt for storage. Never save passwords in plain text. If your using Python, check out the webapp auth api, which takes care of everything for you -> https://webapp-improved.appspot.com/api/webapp2_extras/auth.html

Upvotes: 2

Lipis
Lipis

Reputation: 21835

Don't reinvent the wheel and (as already mentioned in the comment) just use SSL.

It works out of the box for *.appspot.com domains (example) but if you want to enable it for your custom domain you will have to go through documentation.

Upvotes: 4

Related Questions