GAE - 如何创建仅由应用程序使用的私有URL？

Question

Using GAE with Python for this project.

I am creating a page with a chart of statistics that updates(refreshes) itself (every 10 sec) using AJAX. It is my first time using AJAX. What I am thinking is, that I should create a private page that will give the needed information for the statistics chart. Then I simply get the info using AJAX.

Is that the way to go about it? If so how do I make a private page in GAE, I don't want users to be able to go to that page.. Thanks

What are the security concerns for a production quality application?

Answer 1

AJAX is simply Javascript sending HTTP requests. From a server point of view, there is no way to differentiate between user requests and Javascript requests. So there is no such thing as "private page".

Answer 2

You can simply require a login for your private page and your AJAX handler and set the login level to admin . You may require a login for one or more Urls.

Edit

Set login: required , which will require users to login via their Google Accounts, but still all users with Google Accounts will be able to access it. Then in the AJAX handler check if the user is one of the users that you have given access to: https://developers.google.com/appengine/docs/python/users/