CODEWITHSUNDEEP
pythongoogle-app-engine
Daisuki Honey
Daisuki Honey

Reputation: 157

How can I restrict users for adding a task to task queue?

I tried to make only user "foo" can add a task to the task queue with the following code for Google App Engine but seems like the task failed. (Adding task is successful.)

Before I set "login: required", the code worked.

app.yaml

- url: /main.*
  script: main.app
  login: required

main.py

class ProcessHandler(webapp2.RequestHandler):
  def get(self):
    if users.get_current_user().nickname == 'foo': 
      # Do something here.
    else: 
      self.response.write('access is not allowed. ')

class TaskHandler(webapp2.RequestHandler):
  def get(self):
    q = taskqueue.Queue('myQueue')
    task_url = 'http://myapp.appspot.com/process'
    task = taskqueue.Task(url=url, method='GET')
    q.add(task)

app = webapp2.WSGIApplication([
  ('/addTask', TaskHandler),
  ('/process', ProcessHandler)
  ], debug=True)

How should I change the code so that I can allow only user "foo" can add a task successfully?

Upvotes: 0

Views: 73

Answers (1)

Jeff Deskins
Jeff Deskins

Reputation: 1660

The url is usually a path relative to your application's root directory. Do not include 'http://myapp.appspot.com'.

To prevent users from adding a task to the queue, other than user "foo", you will need to check for that user in your TaskHandler code.

from google.appengine.api import taskqueue

if users.get_current_user().nickname == 'foo': 
        # Add task here
        taskqueue.add(queue_name=‘myQueue’, url='/path/to/my/worker/', params={'key': key})

To prevent anyone from processing the task handler by hitting that url, add headers to verify only App Engine is making the request.

if self.request.headers.get('X-AppEngine-TaskName') is not None:
    # Process task

These headers are set internally by Google App Engine. If your request handler finds any of these headers, it can trust that the request is a Task Queue request. If any of the above headers are present in an external user request to your app, they are stripped. The exception being requests from logged in administrators of the application, who are allowed to set the headers for testing purposes. https://cloud.google.com/appengine/docs/python/taskqueue/overview-push

Upvotes: 1

Related Questions