Gwt + Gae Security: Login page

Question

Google AppEngine's "guestbook" tutorial is very nice and clean.

It's awesome how easy I can authenticate my users via Google Accounts.

Now, imagine if my application was a GWT application.

I can make two pages: Login.jsp and MyApp.jsp then "protect" MyApp.jsp with a simple if / else condition, just like in the guestbook tutorial.

Then my web app will use things like gwt-rpc to ajax-communicate with my services. But...

how can I make this services secure? Do I have to pass them username/password every time and check every time the authentication? Can you tell me more about it?

And what about if I want to use my own Users, instead of Google Accounts? How can I keep my user logged in? By saving the logged user's sessionId inside the User entity for example?

Thx

Answer 1

If the user is logged in using the Users API, all the Javascript RPC calls they make will also carry the authentication cookies required. You can simply check if the user is authenticated using the regular Users API, as you would for an interactive request.