英文:
Golang App-engine OAuth Authorization
问题
我正在使用Go编写一个在Google App Engine上运行的Web应用程序,需要用户身份验证和授权才能访问一些用户数据。
我是否仍然需要使用goauth2和gorilla包来实现授权,还是在"appengine"和"appengine/user"包中有一些原生支持App Engine应用程序的Oauthorization功能?我不介意继续使用goauth2,但如果有更好的方法...
英文:
I am implementing an app-engine webapp written in Go that needs user authentication and authorization to access some user data on Google's APIs.
Do I still need to use the goauth2 and gorilla packages to implement authorization or is there some functionality in the "appengine" and "appengine/user" packages that implements Oauthorization natively for app-engine apps? I do not mind going ahead with goauth2, but if there is a better way...
答案1
得分: 2
你可以使用"appengine/user"包来进行OAuth身份验证,但是很抱歉,你必须自己实现授权部分。
关于使用"appengine/user"包进行OAuth身份验证,请参考https://developers.google.com/appengine/docs/go/oauth/#Go_OAuth_and_App_Engine。
英文:
You can use the "appengine/user" package for authentication with OAuth but I'm a fraid that you must implement authorization yourself.
For OAuth authentication with "appengine/user" package, see https://developers.google.com/appengine/docs/go/oauth/#Go_OAuth_and_App_Engine
答案2
得分: 2
以下是来自Google App Engine文档网站上的OAuth for Go Overview的示例:
import (
"fmt"
"net/http"
"appengine"
"appengine/user"
)
func welcome(w http.ResponseWriter, r *http.Request) {
c := appengine.NewContext(r)
u, err := user.CurrentOAuth(c, "")
if err != nil {
http.Error(w, "OAuth Authorization header required", http.StatusUnauthorized)
return
}
if !u.Admin {
http.Error(w, "Admin login only", http.StatusUnauthorized)
return
}
fmt.Fprintf(w, "Welcome, admin user %s!", u)
}
看起来appengine/user
包中有一个名为user.CurrentOAuth()
的函数,提供了身份验证功能。
关于授权,有一个使用OpenID的示例在这里。
需要注意的是,文档中指出:
请注意,使用OAuth来识别用户与标准用户身份验证模式完全无关。例如,如果用户仅通过OAuth进行身份验证,那些标记为
login: required
或login: admin
的页面将拒绝加载。
完整的Go GAE参考文档可在这里找到。
英文:
Here's an example from the OAuth for Go Overview on the Google App Engine Docs site:
import (
"fmt"
"net/http"
"appengine"
"appengine/user"
)
func welcome(w http.ResponseWriter, r *http.Request) {
c := appengine.NewContext(r)
u, err := user.CurrentOAuth(c, "")
if err != nil {
http.Error(w, "OAuth Authorization header required", http.StatusUnauthorized)
return
}
if !u.Admin {
http.Error(w, "Admin login only", http.StatusUnauthorized)
return
}
fmt.Fprintf(w, `Welcome, admin user %s!`, u)
}
It looks like appengine/user
has the function user.CurrentOAuth()
to provide authentication functionality.
For authorization, there's an example using OpenID Here.
There is a caveat; The documentation states:
> Note that using OAuth to identify your users is completely orthogonal to the standard user authentication modes. For example, pages marked with login: required or login: admin will refuse to load if the user is only authenticated via OAuth.
Full Go GAE reference available Here.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论