A matter of trust ::: Daily Python-URL
2008-07-20
App Engine Fan:
A matter of trust
["... assume that you have built a small tool that you would like to share only with family and friends. How could you prevent other, unauthorized people, to just gain access to your app? One solution to the problem is store a list of permitted users in a list (either hardcoded or in a database). This will work if you know exactly who the selected few are. but is also means that you have to administer the list and keep it up to date. A more generic system would be an invitation based access like gmail originally had, but that would mean one would also need to manage those invitations somehow in the database. The following example shows a middle ground -- a simple technology called HMAC to make sure a particular google account is actually supposed to have access."]