如何在登录名中使用自定义身份验证：app.yaml中的required属性（Google App引擎，python）

Question

On Google app engine I use a custom user class with methods. ( Not the class and functions provided by webapp2 )

However, I still need to block users from accessing certain static directory url's with html pages behind them. The current solution I have is that the user authentication happens after the user visits the page, but they still see the entire page loaded for a moment. This looks bad and is not very secure.

How can I use a custom authentication option with the login : required attribute in the YAML file? So that users are immediately redirected ( before landing on the page ) when they are not logged in.

Answer 1

Essentially, you have the following alternatives: either give up on static file / dir serving directly from App Engine infrastructure (transparently to your application), or give up on using your custom user class for authentication.

I suspect you'll pick the first alternative, serving all files from your app (at least, all files that must be kept secret from all but authorized users) -- that "just" costs more resources (and possibly slightly increases latency for users), but lets you implement whatever functionality you require.

The advantage of serving static files/dirs directly with the static_files: &c directives in app.yaml is that your app does not actually get involved -- App Engine's infrastructure does it all for you, which saves you resources and possibly makes things faster for users (better caching/CDN-like delivery). But if your app does not actually get involved, then how could any code you wrote for custom auth possibly be running?! That would be a logical contradiction...

If you're reluctant to serve static files from your app specifically because they're very large, then you can get the speed fully back (and then some), and some resource savings back too, by serving the URL from your app, but then, after authentication, going right on to Google Cloud Storage for it to actually do the serving.

More generally, a mix of files you don't actually need to keep secret (place those in static_dir &c app.yaml directives), ones that are large enough to warrant serving from Cloud Storage, and ones your app can best serve directly, can let you optimize along all fronts -- while keeping full control of your custom auth wherever it matters!