How to restrict access to non-default versions?

[Craig]

Is there a simple way to restrict access to non-default versions?  I'd like for administrators to have access to them, but nobody else.  I'm sure it's not too bad to code up something to handle this, but it seems like something the platform would provide (although I couldn't find any such feature).

[Jose Montes de Oca]

Hi,

just need to add a restriction to the app configuration file to only access by the admin.

If you are working with python you would need to modify app.yaml and add login: admin to the urls in the handlers section. more info:

http://code.google.com/appengine/docs/python/config/appconfig.html#Requiring_Login_or_Administrator_Status

For java: you would need to add security constrains to your web.xml. more info:

http://code.google.com/appengine/docs/java/config/webxml.html#Security_and_Authentication

Hope this helps!

[Craig]

I was thinking of something to click in the admin web console, but making the configuration change will certainly do it - I didn't think of doing it that way.  Thanks!

[Ikai Lan (Google)]

Craig,

We should probably look at making this a real feature. The configuration isn't the best solution because it means you need to swap the config in and out between deploys. It also means that if you want to restrict access to a staging version, you won't be able to just click the dashboard to switch versions after a deploy or rollback.

If you're using Java, it might even be better to create a filter that detects the request URI and forcing an admin login. You can programmatically detect the version, but again, this breaks your ability to deploy/rollback without a change:

http://code.google.com/appengine/docs/java/javadoc/com/google/appengine/api/utils/SystemProperty.html

Unless you store the current version in Memcache and do a check each time ... again, not a great solution.

Ikai Lan 
Developer Programs Engineer, Google App Engine

Blog: http://googleappengine.blogspot.com 

Twitter: http://twitter.com/app_engine

Reddit: http://www.reddit.com/r/appengine

On Wed, Jul 20, 2011 at 10:32 PM, Craig <craigt...@gmail.com> wrote:

I was thinking of something to click in the admin web console, but making the configuration change will certainly do it - I didn't think of doing it that way.  Thanks!

--
You received this message because you are subscribed to the Google Groups "Google App Engine" group.

To view this discussion on the web visit https://groups.google.com/d/msg/google-appengine/-/VsxuIjOkdrwJ.

To post to this group, send email to google-a...@googlegroups.com.
To unsubscribe from this group, send email to google-appengi...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/google-appengine?hl=en.

[Craig Landry]

I agree, I would prefer the "real feature". For now I'm planning to
write a little script to download the version's code from GAE (since
my own code will have been modified since then), change the config
file, and upload it back into GAE.

Is there a formal place I can go to make a feature request for this?

[Ikai Lan (Google)]

Yeah, search the issues tracker:

http://code.google.com/p/googleappengine/issues/list

Ikai Lan 
Developer Programs Engineer, Google App Engine

Blog: http://googleappengine.blogspot.com 

Twitter: http://twitter.com/app_engine

Reddit: http://www.reddit.com/r/appengine

[Craig]

Thanks.  I didn't see any similar request, so I've created #5380