app.yaml 处理程序登录：管理选项对标准 env python GAE 应用程序无效？

Question

I was working on some security checks for my standard env python GAE app and I was surprised to see that the login: admin option appears to be non-effective.我正在为我的标准 env python GAE 应用程序进行一些安全检查，我惊讶地发现login: admin选项似乎无效。

I want to secure a portion of a request namespace to just the app itself, not external requests.我想将请求命名空间的一部分保护到应用程序本身，而不是外部请求。 The app sends these requests through a push task queue.应用程序通过推送任务队列发送这些请求。

This is the respective handler configuration, which I checked in StackDriver to be the actual code that handled the particular request in question:这是各自的处理程序配置，我在 StackDriver 中检查它是处理相关特定请求的实际代码：

- url: /ci/ci_msg*  # external requests OK
  script: apartci.app
  secure: always

- url: /ci/.*       # internal requests only
  script: apartci.app
  secure: always
  login: admin

This is the handler code, hacked to log an error to check if the request actually hits the app code, also verified in StackDriver to be the actual handling code:这是处理程序代码，被黑客入侵以记录错误以检查请求是否实际命中应用程序代码，也在 StackDriver 中验证为实际处理代码：

def post(self):
    logging.error('in post')
    self.handle_post()

I sent the external request to the exact same path that only the internal task queue requests should be accepted, using the Firefox HttpRequester add-on.我使用 Firefox HttpRequester 附加组件将外部请求发送到只应接受内部任务队列请求的完全相同的路径。 The request body failed the additional checks in self.handle_post() , but that's irrelevant for this question.请求主体未通过self.handle_post()的附加检查，但这与此问题无关。

The response I got in HttpRequester (rather irrelevant as well):我在 HttpRequester 中得到的响应（也不相关）：

<html>
 <head>
  <title>203 Non-Authoritative Information</title>
 </head>
 <body>
  <h1>203 Non-Authoritative Information</h1>
  <br /><br />
 </body>
</html>

I checked the app logs in StackDriver.我检查了 StackDriver 中的应用程序日志。 To my surprise I found the logging.error('in post') app log from my handler's post() method attached to the request log, indicating that the request made it to my app:令我惊讶的是，我发现我的处理程序的post()方法中的logging.error('in post')应用程序日志附加到请求日志，表明该请求已发送到我的应用程序：

For comparison - the log from the same request sent from the app itself (coincidentally just ~1 second before the external one and handled by the exact same instance - which contributed to my confusion):为了进行比较 - 来自应用程序本身发送的相同请求的日志（巧合的是，在外部请求之前约 1 秒并由完全相同的实例处理 - 这导致了我的困惑）：

My expectation was for the external request to not make it to the handler code, according to the login row in Handlers element :根据Handlers 元素中的登录行，我的期望是外部请求不会进入处理程序代码：

admin行政

As with required , performs auth_fail_action if the user is not signed in. In addition, if the user is not an administrator for the application, they are given an error message regardless of the auth_fail_action setting.与required 一样，如果用户未登录，则执行auth_fail_action 。此外，如果用户不是应用程序的管理员，无论auth_fail_action设置如何，他们都会收到一条错误消息。 If the user is an administrator, the handler proceeds.如果用户是管理员，则处理程序继续。

When a URL handler with a login setting other than optional matches a URL, the handler first checks whether the user has signed in to the application using its authentication option .当登录设置不是optional的 URL 处理程序与 URL 匹配时，处理程序首先检查用户是否已使用其身份验证选项登录到应用程序。 If not, by default, the user is redirected to the sign-in page.如果没有，默认情况下，用户将被重定向到登录页面。 You can also use auth_fail_action to configure the app to simply reject requests for a handler from users who are not properly authenticated, instead of redirecting the user to the sign-in page.您还可以使用auth_fail_action将应用程序配置为简单地拒绝未经过正确身份验证的用户对处理程序的请求，而不是将用户重定向到登录页面。

Note: the admin login restriction is also satisfied for internal requests for which App Engine sets appropriate X-Appengine special headers.注意：对于 App Engine 为其设置适当X-Appengine特殊标头的内部请求，管理员登录限制也得到满足。 For example, cron scheduled tasks satisfy the admin restriction, because App Engine sets an HTTP header X-AppEngine-Cron: true on the respective requests.例如， cron计划任务满足管理限制，因为 App Engine 在相应的请求上设置了 HTTP 标头X-AppEngine-Cron: true 。 However, the requests would not satisfy the required login restriction, because cron scheduled tasks are not run as any user.然而，请求将不能满足所需的登录限制，因为cron的计划任务没有任何用户运行。

So my question is why/how did the external request manage to hit the handler code?所以我的问题是为什么/如何外部请求设法命中处理程序代码？ Am I missing something?我错过了什么吗？

Answer 1

Mistery solved: apparently the Firefox HttpRequester add-on is smart enough to automatically pull the google credentials from Firefox and use them.谜团已解决：显然 Firefox HttpRequester 附加组件足够智能，可以自动从 Firefox 中提取 google 凭据并使用它们。 The updated image in the question now has a pointer showing the username info I blacked out but didn't regard as a clue.问题中更新后的图像现在有一个指针，显示我已涂黑但未将其视为线索的用户名信息。 Those credentials have admin permissions to the GAE app, which explains why that request made it to the handler code.这些凭据对 GAE 应用程序具有管理员权限，这就解释了为什么该请求会发送到处理程序代码。

To confirm this theory I tried the same request but this time sent using curl :为了证实这个理论，我尝试了相同的请求，但这次使用curl发送：

$ curl --request POST --data '{"task": "project_integrity_check_task", "obj_id": 4841240159846400, "ci_proj": 4841240159846400, "obj_cls": "Project"}' [url_redacted] $ curl --request POST --data '{"task": "project_integrity_check_task", "obj_id": 4841240159846400, "ci_proj": 4841240159846400, "obj_cls": "Project"}' [url_redacted]

The response is indeed a 302 and the app error log is missing, indicating that this time the request didn't make it to the handler code, as expected:响应确实是302并且缺少应用程序错误日志，表明这次请求没有像预期的那样到达处理程序代码：

app.yaml 处理程序登录：管理选项对标准 env python GAE 应用程序无效？

问题描述

1 个解决方案

解决方案1
2 已采纳 2017-10-20 01:07:14

app.yaml 处理程序登录：管理选项对标准 env python GAE 应用程序无效？

问题描述

1 个解决方案

解决方案1 2 已采纳 2017-10-20 01:07:14

解决方案1
2 已采纳 2017-10-20 01:07:14