英文:
OAuth2 in Go with Google App Engine
问题
我正在翻译以下内容:
我正在研究在Google App Engine中使用Go语言和OAuth2。这里有一个带有示例的链接:
https://developers.google.com/appengine/docs/go/users/#Go_OAuth_in_Go
但是,我对以下备注不太清楚:
请注意,使用OAuth来识别用户与标准用户身份验证模式完全无关。例如,如果用户仅通过OAuth进行身份验证,那么标记为"login: required"或"login: admin"的页面将拒绝加载。
这是否意味着我不能在OAuth中使用标准的身份验证模式?
我可以使用其他提供商(如Facebook)与用户包一起使用吗?
还是说,与默认的用户包相比,使用这个包更好?
https://code.google.com/p/goauth2/
使用这个包有什么缺点吗?
(我只需要用它进行身份验证)
英文:
I'm looking into using OAuth2 with Go in Google App Engine.
Here is a link with an example:
https://developers.google.com/appengine/docs/go/users/#Go_OAuth_in_Go
But this remark isn't clear to me:
Note that using OAuth to identify your users is completely orthogonal to the
standard user authentication modes. For example, pages marked with
login: required or login: admin will refuse to load if the user is
only authenticated via OAuth.
Does this mean I can't use the standaard authentication mode with OAuth?
Can I use other providers like Facebook with the user package?
Or is it better to use this package instead of the default user package?
https://code.google.com/p/goauth2/
Are there disadvantages to using this?
(I only need it for authentication)
答案1
得分: 1
这只是意味着在app.yaml/module.yaml中的"login"键不会将通过OAuth进行身份验证的用户视为已经身份验证,并且会拒绝他们访问该资源。
例如,如果您在/admin/创建了一个页面,并且希望GAE强制只有经过身份验证的人才能访问该页面,那么您需要确保他们使用的是Google帐号进行身份验证,而不是OAuth登录。在使用OAuth登录后访问该页面的任何人仍将被GAE视为未经身份验证。
这只是意味着如果您有一些只想让经过身份验证的人看到的页面,并且希望支持OAuth作为有效的身份验证方法,那么您需要在.yaml文件中不设置"login"键来定义这些资源。然后,您需要自己强制执行在允许他们访问该资源之前已经登录。在这种情况下,GAE无法帮助您。
英文:
This just means that the app.yaml/module.yaml key "login" won't consider users who have authenticated via OAuth to be authenticated and will deny them access to that resource.
For example, if you have created a page at /admin/ and you want GAE to enforce that only people who have authenticated can access that page, then you need to ensure that they have authenticated using a google account, not an OAuth login. Anyone accessing that after they have logged in using OAuth will still appear unauthenticated to GAE.
All that this means is that if you have pages you only want authenticated people to see and you want to support OAuth as a valid authentication method, then you need to not have the "login" key set for those resources in the .yaml file. Then it's up to you to enforce that they have been logged in before allowing them access to that resource. GAE can't help you out in that case.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论