How does Google App Engine User Service work internally?

Question

I'm just curious about how Google app engine's user service works. The way I understand it, the user logged in state is stored in the cookie. To get the cookie, one has to have a http servlet request object (for java servlet at least). But the user service api doesn't require any http servlet request as input, so how does it get the cookie to check the whether the user is logged in or not?

Tim

Answer 1

During requests, user setup is handled by Google's servlet implementation.

[I]f the user is signed in and get the user's email address or OpenID identifier using the standard servlet API, with the request object's getUserPrincipal() method.

During the login process, the service works using redirects, similar to OpenID or OAuth. Take a look a the URLs throughout the login process.

1. Users are redirected to a URL, which is handled by App Engine, on your app, something like:

   http://app.appspot.com/_ah/login?continue=http://app.appspot.com/dosomething

2. The login handler redirects to the Google login service, something like:

   https://www.google.com/accounts/ServiceLogin?service=ah&continue=http://app.appspot.com/_ah/login%3Fcontinue%3Dhttp://app.appspot.com/dosomething&ltmpl=gm&ahname=Your+App+Name&sig=hf3322hdsk98fd8fh3u29hfh24as

3. You login, then Google redirects you back to the app engine login handler:

   http://app.appspot.com/_ah/login?continue=http://app.appspot.com/dosomething

   When Google redirects, some query parameters will be passed to the App Engine login handler, and the built-in login handler will set the cookie.

4. You are then redirected to the URL you specified, or where you 'started' from. Something like:

   http://app.appspot.com/dosomething

Answer 2

What about the in the subsequent calls? For example (continuing from your point 4)

1. User calls the servlet http://app.appspot.com/dosomethingelse

In the servlet dosoemthingelse, I can again call UserService like this

UserService userService = UserServiceFactory.getUserService();
User user = userService.getCurrentUser();
String userId = user.getUserId();

How does this userService instance gets the cookie to know who is the currently logged in user?