Limiting Google Apps Script Web app to certain users only

Question

Making a web app that makes changes to certain (Sheets) files on my Google Drive (i.e. user will use the app as me), but I would like to restrict the Web app access only to certain users. When deploying app, I only have the options of making it private or public. One solution would be to use the session class to see if a correct user is logged in.

function onAppBegin(){

 if (Session.getActiveUser().getEmail() != "[email protected]") return null;
 accessGranted();
}

However, I am concerned if this crude method is actually safe and is not hackable?

Answer 1

The method is too safe: nobody will have access. If your web app is deployed with the option "Execute the app as: me", then Session.getActiveUser().getEmail() will probably return the empty string. See documentation:

The circumstances in which the email address is available vary: for example, the user's email address is not available in any context that allows a script to run without that user's authorization, like [...] a web app deployed to "execute as me" (that is, authorized by the developer instead of the user). However, these restrictions generally do not apply if the developer and the user belong to the same G Suite domain.

The issue is that even though the user logged in to access the web app, they did not authorize it to do anything on their behalf, e.g., find their email address.

If the web app is deployed to be executed by "User accessing the web app", then they will be asked to authorize it, and so the web app can learn their identity. But then, it will only be able to modify those files that the user already can modify directly.

The way I get around this difficulty is by giving the authorized users a key to the web app (some long random string). They access the app by going to https://..../exec?key=mykey, and the app checks the key as follows:

function doGet(e) {
  if (e.parameter.key == "mykey") {
    var ss = SpreadsheetApp.openById("spreadsheet Id");  
    // modify the spreadsheet
  }
}

Now, this is even more crude than your original approach, but it works. If a wrong person gets the key, they will be able to use the app but the damage will be limited to what the app can do. It's not nearly as bad as someone getting access to your Google Account.