CODEWITHSUNDEEP
google-app-engine
diogovk
diogovk

Reputation: 2228

How to call admin endpoints on GAE without resorting to low level tools?

We're using Google App Engine (python) and Google Cloud Endpoints (OpenAPI). We have some endpoints for admin-exclusive use. In our app.yaml we have something like this:

handlers:
- url: /_ah/api/appname/v1/admin/.*
  script: main.api
  login: admin

Usually I use Postman when I need to POST a special request, but for requests to login: admin endpoints, Postman redirects to and opens source of the Google Login page, which doesn't actually allow me to login.

If I open such redirect URL in the browser, I'm actually able to login, but after that, I'm redirected to the GET version of the endpoint, which doesn't help as well. I don't think the browser has a feature which easily allows me to make a custom POST requests after I've login.

So in the end I see two alternatives... one would be "importing" the authentication cookies into POSTMAN after login. The other would be use javascript in the browser's console to "manually" make the POST request I'm trying to make.

Both options seem to me somewhat overcomplicated, and I feel like I gotta be missing some easier way of doing what I'm trying to do.

So my question is what's an easy way to make a POST request to a deployed google cloud endpoint which is protected by login: admin?

Upvotes: 1

Views: 92

Answers (2)

diogovk
diogovk

Reputation: 2228

The cookie associated with authenticating this kind of endpoint protection is called SACSID, and the domain is your own application domain, that is, in the format project.appspot.com.

You should be able to call an endpoint using the browser, which will redirect you to the google login page, and after authenticating you should be able to copy the cookie into Postman, allowing you to make authenticated endpoint calls from there.

When adding it in Postman, you'll need the domain, the cookie name and its value.

Upvotes: 0

Happy-Monad
Happy-Monad

Reputation: 2002

Upon investigating I see you're using App Engine with Python 2.7 runtime and that the login: admin endpoint is authenticated with Google Accounts. When you protect the endpoints all requests made to it need to be properly authenticated in order to be accepted, therefore you actually need to provide your authentication credentials to the server with every request. Since the credentials posseses a Time To Live for security reasons you cannot simplify the process permanently storing them in a file.

The answer is indeed in your question, if you want to use POSTMAN you have to import the cookies after login or create a script that handles both the authentication process and the subsequent request. Here's the documentation for POSTMAN if you decide to go this way and here's Google's documentation on making authenticated API requests.

Nevertheless, there are some important things to note. Python 2.7 is sunsetting, this means that security vulnerabilities may appear and probably won't get patched which could result in huge security breaks and/or the need to rewrite your whole backend in the newer python runtime; Google's documentation encourages the switch.

Additionally, the users library will be deprecated at some point too, so you might consider changing your authentication scheme to use Auth0 with the advantage that this option is available for both runtimes.

Upvotes: 1

Related Questions