Google AppEngine：自定義身份驗證

Question

我可以使用Google帳戶在AppEngine中對我的用戶進行身份驗證的方式簡直太棒了。

不過，我需要用我的定製認證登錄系統。

我將有一個AppUsers表，用用戶名和加密的密碼。

我讀一些關於GAE的會議，但我需要啓動我的應用程序安全性的幫助。

我如何跟蹤我的身份驗證的用戶會話？設置一個cookie？

初學者。

Answer 1

可以使用的cookie這樣做...這是真的不是那麼難。您可以使用cookie跟蹤用戶的身份驗證並將會話密鑰存儲在gae數據存儲中。

有一個例子（它只是顯示基本的想法，我不保證該代碼可以直接使用）

基本的用戶表：

# simply add an property to store the session key 
class User(db.Model):  
    username = db.StringProperty() 
    password = db.StringProperty() 
    session = db.StringProperty() 

登錄功能

# Do the following step: 
# 1. make sure user provide correct username and password 
# 2. generate a random session key 
# 3. store the session key to datastore 
# 4. set the session key and user name in cookie 
class LoginAPI(Webapp.RequestHandler): 
    def get(self): 
     username = self.getVar('username', username) 
     password = self.getVar('password', password) 

     user = User.all().filter("username = ", username).get() 
     password = encrypted_the_password(password) # encrypted your password with your own method! 

     if user.password == password: 
      # User login successfually 
      session = generate_random_session_key() # generate your session key here 
      user.session = session 
      user.put() 

      expires_time = decide_your_expires_time() # decide how long the login session is alive. 
      cookie_time_format = "%a, %d-%b-%Y %H:%M:%S GMT" 
      expires_datetime = datetime.datetime.fromtimestamp(expires_time) 

      # set cookie as session 
      self.response.headers.add_header("Set-Cookie", "user=%s; expires=%s; path=/" % (user.username,expires_datetime.strftime(cookie_time_format))) 
      self.response.headers.add_header("Set-Cookie", "session=%s; expires=%s; path=/" % (user.session, expires_datetime.strftime(cookie_time_format))) 
     else: 
      #User login failed 
      pass 

註銷功能

# Remove the previous cookie info 
class LoginAPI(Webapp.RequestHandler): 
     def get(self): 
      # remove the cookie 
      self.response.headers.add_header("Set-Cookie", "user=%s; expires=%s; path=/" % ("",expires_datetime.strftime(cookie_time_format))) 
      self.response.headers.add_header("Set-Cookie", "session=%s; expires=%s; path=/" % ("", expires_datetime.strftime(cookie_time_format))) 

當您需要用戶登錄

# Get the session info from cookie. If the session info match the info stored in datastore 
# Then user authenticate successfully. 
class SomePage(Webapp.RequestHandler): 
    def get(self): 
     # get cookie info 
     username_from_cookie = self.request.cookies.get("user", "") 
     session_from_cookie = self.request.cookies.get("session", "") 

     if username_from_cookie and session_from_cookie: 
      user = User.all().filter("username = ", username_from_cookie).get() 
      if user.session == session_from_cookie: 
       # the user is login correctly 
       pass 
      else: 
       # the user is not login 
       pass 
     else: 
      # the user is not login 
      pass