Google Cloud Storage user-centric authentication

Question

My aim to make Google Cloud Storage files accessible directly from clients with an access token (without Gmail, Facebook etc.). I want an architecture like that:

While creating a Storage file, the server will create a file and assign it a key generated by the server and send it to authorized clients. Only the clients who have the key can only access to Storage file.

@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

    String generatedString = getAlphaNumericString(16);


    GcsFilename gcsFileName = new GcsFilename("feist*******2.appspot.com", generatedString);
    GcsFileMetadata metaData = gcsService.getMetadata(gcsFileName);

    while(metaData != null) {
        generatedString = getAlphaNumericString(16);
        gcsFileName = new GcsFilename("feist*********2.appspot.com", generatedString);
        metaData = gcsService.getMetadata(gcsFileName);
    }

    /*GcsFileOptions.Builder builder = new GcsFileOptions.Builder();

    builder.acl("public-read");*/

    GcsFileOptions instance = GcsFileOptions.getDefaultInstance();
    GcsOutputChannel outputChannel;
    outputChannel = gcsService.createOrReplace(gcsFileName, instance);
    copy(req.getInputStream(), Channels.newOutputStream(outputChannel));


    JSONObject jsonWriter = new JSONObject();
    jsonWriter.append("result", "ok");
    jsonWriter.append("path", generatedString);

    resp.setContentType("application/json; charset=UTF-8");
    PrintWriter out = resp.getWriter();
    out.print(jsonWriter.toString());

}

I have added my simple java code to create an file and upload data to it. Is there any way to add this file a key to access directly from a client which has the key generated by server.

Note: I have a 3-tier messaging application. I am using Firebase Cloud Messaging for downstream notification (I think it is out of topic). For storage (image, sound etc), I am using Google Cloud Storage. I don't want to make my storage publicly accessible. I also don't want to implement server-centric authentication to access Google Cloud Storage resources.

llompalles llompalles · Accepted Answer · 2019-04-22T10:15:15

Avoid all this token generation headache using Signed URLs instead. They are designed to accomplish the same feature you are asking for.

Take a look at the Java Client library for Cloud Storage to know how to generate them.

Google Cloud Storage user-centric authentication

1 Answers