可以在Google App Engine上使用Ajax作为来自nonappspot.com域的https登录用户吗？

Question

Suppose:

1. You have a website http://www.example.com that redirects to a project on Google App Engine (ie example.appspot.com);
2. you want communications to pass between the user over SSL (ie https://example.appspot.com ); and
3. You want the domain to be shown to the user to be *://www.example.com (ie not https://example.appspot.com ).

Given that Google's Appspot HTTPS support only works for https://example.appspot.com (ie you cannot set up https://www.example.com with GAE), I'd like to have an Ajax solution, namely:

1. http://www.example.com serves HTML and Javascript over http
2. Ajax requests go over SSL to https://example.appspot.com

My question/concern is: How does one ensure that the users logged into http://www.example.com (by way of Google's users API ) pass their authentication credentials over Ajax to https://example.appspot.com ?

This seems to be a violation of the same origin policy (which may or may not be a concern for the Google Users API), so how would one know what user is logged in to example.com for the Ajax requests to example.appspot.com?

Thoughts, comments and input is quite appreciated.

Thank you.

Brian

Answer 1

当两个站点合作时，有很多方法可以解决同源问题，例如，请参阅此帖子 ，但只有反复试验才能揭示哪些技术可以满足您的特定要求（这可能取决于用户设置安全保护措施的严格程度）他们的浏览器，以及服务器端实现）。

Answer 2

You can try using JSONP to get around the around that. However JSONP doesnt have very good error recovery like JSON does when doing XHR calls.

Answer 3

Wouldn't it be far simpler to use frames? Serve up a single full-size frameset from yourdomain.com containing content from https://yourapp.appspot.com/ .

Note, though, that either solution has the problem that users see an unsecured site, not a secured one.

Answer 4

example.appspot.com does not share any cookies with example.com - it will be impossible for you to identify the user without making them sign-in on example.appspot.com as well.

you could, of course, completely ditch Google Authentication on example.appspot.com and implement your own scheme; you could append a signature and the username to the AJAX requests you create and verify that signature on your app-engine app. if the signature is valid, just accept the user that was passed in as the authenticated user and pretend he logged in.