Can one use Ajax on Google App Engine as a logged in user over https from a non-appspot.com domain?

Question

Suppose:

1. You have a website http://www.example.com that redirects to a project on Google App Engine (i.e. example.appspot.com);
2. you want communications to pass between the user over SSL (i.e. https://example.appspot.com); and
3. You want the domain to be shown to the user to be *://www.example.com (i.e. not https://example.appspot.com).

Given that Google's Appspot HTTPS support only works for https://example.appspot.com (i.e. you cannot set up https://www.example.com with GAE), I'd like to have an Ajax solution, namely:

1. http://www.example.com serves HTML and Javascript over http
2. Ajax requests go over SSL to https://example.appspot.com

My question/concern is: How does one ensure that the users logged into http://www.example.com (by way of Google's users API) pass their authentication credentials over Ajax to https://example.appspot.com?

This seems to be a violation of the same origin policy (which may or may not be a concern for the Google Users API), so how would one know what user is logged in to example.com for the Ajax requests to example.appspot.com?

Thoughts, comments and input is quite appreciated.

Thank you.

Brian

Answer 1

There are ways to work around same-origin when both sites cooperate, e.g. see this post, but only trial-and-error will reveal which techniques do work for your specific requirements (it may depend on how strictly the user has set security safeguards in their browser, as well as on server-side implementations).

Answer 2

Wouldn't it be far simpler to use frames? Serve up a single full-size frameset from yourdomain.com containing content from https://yourapp.appspot.com/.

Note, though, that either solution has the problem that users see an unsecured site, not a secured one.

Answer 3

You can try using JSONP to get around the around that. However JSONP doesnt have very good error recovery like JSON does when doing XHR calls.

Answer 4

example.appspot.com does not share any cookies with example.com - it will be impossible for you to identify the user without making them sign-in on example.appspot.com as well.

you could, of course, completely ditch Google Authentication on example.appspot.com and implement your own scheme; you could append a signature and the username to the AJAX requests you create and verify that signature on your app-engine app. if the signature is valid, just accept the user that was passed in as the authenticated user and pretend he logged in.