How to protect a Google App Engine app with a password?

Question

How would you implement simple password protection on a Google App Engine application? No users authentication, just simple requirement to enter a password in order to open specific page. The other requirement is that the target page should not be displayed if its URL is entered directly.

I'm looking for a solution using Python.

Answer 1

If you're protecting a single page and need no session persistence.

class MainPage(webapp.RequestHandler):
    def post(self):
        if self.request.get('user') == 'admin' and self.request.get('pass') == 'soopersecure':
            self.response.out.write('authorized');
        else:
            self.response.out.write("""
<form method="post">
<input type="text" name="user"/>
<input type="password" name="pass"/>
<input type="submit" value="login"/>
</form>""")

Otherwise you could hash the username + salt and hand it to user as a session ID in a cookie and store that session ID into the datastore. Much simpler to use Google accounts though.

http://code.google.com/appengine/docs/python/gettingstarted/usingusers.html

Answer 2

If you want to restrict access for the entire app, use URL handler with "login" setting

Check - User and Administrator Login