Google AppEngine: custom authentication

Question

The way I can authenticate my users in AppEngine using Google Accounts is simply wonderful.

However, I need to use my custom authentication-login system.

I will have a AppUsers table, with usernames and encrypted passwords.

I read something about sessions on gae, but I need help on starting up my app security.

How can I track my authenticated user session? Setting a cookie?

A beginner.

Answer 1

You can use cookie to do so... It is really not so hard. You can use cookie to track user's authenticated and store the session key in gae datastore.

There is an example (It just show the basic idea, I don't guarantee the code can be used directly)

The Basic User Table:

# simply add an property to store the session key
class User(db.Model):    
    username = db.StringProperty()
    password = db.StringProperty()
    session = db.StringProperty()

The Login function

# Do the following step:
# 1. make sure user provide correct username and password
# 2. generate a random session key 
# 3. store the session key to datastore
# 4. set the session key and user name in cookie
class LoginAPI( Webapp.RequestHandler ):   
    def get(self):
        username = self.getVar( 'username', username )
        password = self.getVar( 'password', password )

        user = User.all().filter("username = ", username).get()
        password = encrypted_the_password(password) # encrypted your password with your own method!

        if user.password == password:
             # User login successfually
             session = generate_random_session_key() # generate your session key here
             user.session = session
             user.put()

             expires_time = decide_your_expires_time() # decide how long the login session is alive.
             cookie_time_format = "%a, %d-%b-%Y %H:%M:%S GMT"
             expires_datetime = datetime.datetime.fromtimestamp(expires_time)

             # set cookie as session
             self.response.headers.add_header( "Set-Cookie", "user=%s; expires=%s; path=/" % ( user.username,expires_datetime.strftime( cookie_time_format ) ) )
             self.response.headers.add_header( "Set-Cookie", "session=%s; expires=%s; path=/" % ( user.session, expires_datetime.strftime( cookie_time_format ) ) )
        else:
             #User login failed
             pass

The logout function

# Remove the previous cookie info 
class LoginAPI( Webapp.RequestHandler ):
        def get(self):
            # remove the cookie
            self.response.headers.add_header( "Set-Cookie", "user=%s; expires=%s; path=/" % ( "",expires_datetime.strftime( cookie_time_format ) ) )
            self.response.headers.add_header( "Set-Cookie", "session=%s; expires=%s; path=/" % ( "", expires_datetime.strftime( cookie_time_format ) ) )

When you required user login

# Get the session info from cookie. If the session info match the info stored in datastore
# Then user authenticate successfully.
class SomePage(Webapp.RequestHandler):
    def get(self):
        # get cookie info
        username_from_cookie = self.request.cookies.get("user", "")
        session_from_cookie = self.request.cookies.get("session", "")

        if username_from_cookie and session_from_cookie:
            user = User.all().filter("username = ", username_from_cookie).get()
            if user.session == session_from_cookie:
                # the user is login correctly
                pass
            else:
                # the user is not login
                pass
        else:
            # the user is not login
            pass