我已经在Google app Engine上创建了一个应用程序,现在我将继续讨论安全性。我只想把它锁定在几个Ruby客户端上。我似乎找不到任何地方来解释为非iOS/Android/JavaScript文件保护端点的原因。我想使用身份验证概述的here,我只是不明白如何为我的Ruby应用程序或试图使用他们的web api的客户端应用程序做这件事。
发布于 2015-02-13 15:08:48
在GAE端,您需要为本机应用程序生成一个客户端ID,并使用在allowed_client_ids中填充的生成的客户端ID创建一个受oAuth保护的端点。
以下是一个示例Python端点:
import endpoints
import logging
from protorpc import messages
from protorpc import message_types
from protorpc import remote
CLIENT_ID = 'your_client_id_for_native_app'
class ServerRequestMSG(messages.Message):
status = messages.StringField(1)
class ResponseMSG(messages.Message):
message = messages.StringField(1)
@endpoints.api(name='localcall', version='v0.1',
allowed_client_ids=[CLIENT_ID, endpoints.API_EXPLORER_CLIENT_ID],
scopes=[endpoints.EMAIL_SCOPE],
description='Local endpoints call test')
class LocalCallAPI(remote.Service):
@endpoints.method(ServerRequestMSG, ResponseMSG,
path='authed', http_method='POST',
name='call.authed')
def call_authed(self, request):
current_user = endpoints.get_current_user()
logging.info(request.status)
email = (current_user.email() if current_user is not None
else 'Anonymous')
return ResponseMSG(message='hello %s' % (email,))
app = endpoints.api_server([LocalCallAPI])
在客户端,您需要获取Google API Ruby Client。然后,可以使用此示例调用受oAuth保护的终结点:
require 'google/api_client'
require 'google/api_client/client_secrets'
require 'google/api_client/auth/installed_app'
# Initialize the client.
client = Google::APIClient.new(
:application_name => 'your_local_app_name',
:application_version => 'app_version',
:host => 'your_app_id.appspot.com',
:discovery_path => '/_ah/api/discovery/v1'
)
# Initialize API.
service = client.discovered_api('localcall', 'v0.1')
# Run installed application flow.
flow = Google::APIClient::InstalledAppFlow.new(
:client_id => 'your_client_id_for_native_app',
:client_secret => 'client_secret_from_console',
:scope => ['https://www.googleapis.com/auth/userinfo.email']
)
client.authorization = flow.authorize
# Make an API call.
result = client.execute(
:api_method => service.call.authed,
:parameters => {'status' => 'hello'}
)
正如您所看到的,当调用您自己的discovery_path而不是Google的API时,您需要覆盖host和API的值,并设置API的名称和版本。我认为它没有明确的文档,但是库允许它,这可以在检查库源代码后推断出来。
https://stackoverflow.com/questions/25415214
复制相似问题