Secure remote_api in app engine with OpenID

Question

Hi,

I previously asked a question about using app engine's remote_api with openID, and the answer worked well, both securely and insecurely. At some point soon after, however, something in app engine changed, and the solution no longer worked securely - i.e. the following

remote_api_stub.ConfigureRemoteDatastore(app_id=app_id, path='/remote_api', auth_func=auth_func, servername=host, secure=True)

stopped working (always returning 302), and I needed to remove the secure argument to get it to work.

The release of the 1.3.5 SDK promised 'Remote API commands can be sent over HTTPS or HTTP', which confused me, as I was under the impression that providing the 'secure=True' argument had been giving me this already, based on this discussion.

My suspicion is that it was the release of this feature that caused the 'secure' argument to stop working. So the first part of my question - was I actually running remote_api commands securely by using the 'secure=True' argument, prior to the release of 1.3.5?

Once the cookie hack stopped working securely, I tried out Nick Johnson's solution listed in the same question, but with this also, I could not supply 'secure=True', getting the same 302 response.

What do I need to do to run remote_api securely with openID? Does 1.3.5 include new capabilities around this, and how do I use them? Cheers,

Colin

Answer 1

Regards this

http://code.google.com/intl/en-US/appengine/articles/openid.html

WARNING: at the time of this writing, OpenID is not supported if your app runs in secure mode using HTTPS.

Regards this in last revision in 1.3.7 release

def ConfigureRemoteDatastore(app_id,
                             path,
                             auth_func,
                             servername=None,
                             rpc_server_factory=appengine_rpc.HttpRpcServer,
                             rtok=None,
                             secure=False):
  """Does necessary setup to allow easy remote access to an AppEngine datastore.

  Either servername must be provided or app_id must not be None.  If app_id
  is None and a servername is provided, this function will send a request
  to the server to retrieve the app_id.

  Args:
    app_id: The app_id of your app, as declared in app.yaml.
    path: The path to the remote_api handler for your app
      (for example, '/remote_api').
    auth_func: A function that takes no arguments and returns a
      (username, password) tuple. This will be called if your application
      requires authentication to access the remote_api handler (it should!)
      and you do not already have a valid auth cookie.
    servername: The hostname your app is deployed on. Defaults to
      <app_id>.appspot.com.
    rpc_server_factory: A factory to construct the rpc server for the datastore.
    rtok: The validation token to sent with app_id lookups. If None, a random
      token is used.
    secure: Use SSL when communicating with the server.

So, did you try it with new sdk?