GoogleAppEngine Java WebService安全性

Question

I'm working on small game in Java(using JApplet) and I want to implement highscores and achievements.

I don't have dedicated server, so I decided to use GoogleAppEngine for storage of player data and after generation of highscores and achievements. I have already found out how to create WebServices on GoogleAppEngine, but I have a question regarding security...

I don't want unathorized people to make calls to my WS... What kind of security I can implement to prevent other people to use this WS, only athorized client(which is my Applet) could post there.

My Applet probably will be hosted on my personal web page and WS is going to run on GoogleAppEngine.

Thanks in advance, Serhiy.

Answer 1

Because people aren't going to be hitting your GAE app directly, the google login and the user service might not be very effective... so you might want to look at more conventional security.

There's one way which is to sign all requests with a private key in the applet and check them up with the public key on the GAE. The problem with this way is that you'll have to keep the private key on the applet, which (I'm guessing) can be reverse engineered and stolen.

You could also explore using the cross domain security restrictions on applets... have the applet post back to the server from which it came and have that server communicate with GAE with signed requests.

You could also look at using HTTP_REFERER based security - accepting only requests that originated from your host domain.