Securing Google App Engine Authsub callback url ('next_url')

I have run through the google example of using Authsub to retrieve Google feed data (http://code.google.com/appengine/articles/python/retrieving_gdata_feeds.html)

If I understand correctly, it is possible for a malicious hacker to call the 'next_url' (which google auth service calls with your token) and inject their own token?

Meaning that they could cause the Web apps to write to the Hackers google doc account instead of the authenticated user!

Does anyone know how to secure this url so that only google auth service can call it?

Below is the code I am referring to:

def get(self):
    next_url = atom.url.Url('http', settings.HOST_NAME, path='/step1')

    # Initialize a client to talk to Google Data API services.
    client = gdata.service.GDataService()
    gdata.alt.appengine.run_on_appengine(client)

    # Generate the AuthSub URL and write a page that includes the link
    self.response.out.write("""<html><body>
        <a href="%s">Request token for the Google Documents Scope</a>
        </body></html>""" % client.GenerateAuthSubURL(next_url,
            ('http://docs.google.com/feeds/',), secure=False, session=True))

ansaurus

tags:

views:

answers:

Securing Google App Engine Authsub callback url ('next_url')

related questions