Samples for migrating from Python 2.7 runtime to Python 3.7 #3656
Conversation
… the Python 3.7 version)
engelke
added
the
do not merge
googlebot
added
the
cla: yes
| url = request.form['url'] | ||
| token = id_token.fetch_id_token(reqs.Request(), url) | ||
|
|
||
| resp = requests.get(url, |
There was a problem hiding this comment.
Maybe better as:
resp = requests.get(
url,
headers={'Authorization': 'Bearer {}'.format(token)}
)
| info = id_token.verify_oauth2_token(token, requests.Request()) | ||
| service_account_email = info['email'] | ||
| incoming_app_id, domain = service_account_email.split('@') | ||
| if domain != 'appspot.gserviceaccount.com': # Not App Engine svc acct | ||
| return None | ||
| else: | ||
| return incoming_app_id |
There was a problem hiding this comment.
May also want to verify the audience & issuer here.
The (Python) verify_oauth2_token function verifies the JWT signature, the aud claim, and the exp claim. You must also verify the iss claim and the hd claim (if applicable) by examining the object that verify_oauth2_token returns. If multiple clients access the backend server, also manually verify the aud claim. (ref)
There was a problem hiding this comment.
I thought long and hard about verifying the audience, but eventually decided that I was showing how to migrate from the old X-Appengine-Inbound-Appid approach, which did not perform that check.
The Google verify_oauth2_token verifies tokens issued by Google's OAuth2 server, so I don't think there needs to a separate check of the issuer.
There was a problem hiding this comment.
SGTM.
The text & samples on their website for other languages vs. Python are a little misleading. I will file a bug.
There was a problem hiding this comment.
It's possible that those other language libraries don't do the same issuer
verification automatically.
@engelke Hold on, I thought the text implied that Python doesn't verify issuer automatically.
|
It's been a while from the last activity. Please rebase to the master when you push your next commit. Also I'll close this PR on Fri June 5th. Feel free to reopen with rebasing. |
engelke
dismissed stale reviews from anguillanneuf and gguuss
Issues were addressed in comments.
…samples into msprint
engelke
removed
the
do not merge
Replacing use of Python 2.7 runtime-only libraries for storage and web requests.