为Google应用引擎创建Google用户的替代登录信息

Question

How does one handle logging in and out/creating users, without using Google Users? I'd like a few more options then just email and password. Is it just a case of making a user model with the fields I need? Is that secure enough?

Alternatively, is there a way to get the user to log in using the Google ID, but without being redirected to the actual Google page?

Answer 1

我建议使用OpenID，请参阅此处了解更多信息 - 就像Stack Overflow一样！ - ）

Answer 2

If you roll your own user model, you're going to need to do your own session handling as well; the App Engine Users API creates login sessions for you behind the scenes.

Also, while this should be obvious, you shouldn't store the user's password in plaintext; store an SHA-1 hash and compare it to a hash of the user's submitted password when they login.