views:

454

answers:

2

How does one handle logging in and out/creating users, without using Google Users? I'd like a few more options then just email and password. Is it just a case of making a user model with the fields I need? Is that secure enough?

Alternatively, is there a way to get the user to log in using the Google ID, but without being redirected to the actual Google page?

+8  A: 

I recommend using OpenID, see here for more -- just like Stack Overflow does!-)

Alex Martelli
Ahh nifty. Thanks for the speedy reply.
Dominic Bou-Samra
+1 - but you might want to mention session libraries like Beaker that will be necessary for tracking users once they're logged in. There's also simploid, which provides a bit of glue to make OpenID in App Engine easier: http://github.com/Arachnid/simploid/tree/master . I would add my own answer, but you got in first, fair and square. ;)
Nick Johnson
Simploid looks nifty, thanks Nick!
Alex Martelli
+1  A: 

If you roll your own user model, you're going to need to do your own session handling as well; the App Engine Users API creates login sessions for you behind the scenes.

Also, while this should be obvious, you shouldn't store the user's password in plaintext; store an SHA-1 hash and compare it to a hash of the user's submitted password when they login.

Wooble
...and if you store pwd hashes, don't forget the salt! http://en.wikipedia.org/wiki/Salt_(cryptography)
Alex Martelli
Nah, I was reluctant to use my own model. OpenID sounds the best. Cheers guys
Dominic Bou-Samra