Re: [google-appengine] Is HTTP_X_APPENGINE_INBOUND_APPID authenticated?

2011-07-29 Thread Jon McAlister
It also does not apply if using urlfetch.py, unless you set follow_redirects=False explicitly (or the equivalent option in java). On Fri, Jul 29, 2011 at 11:17 AM, Andrin von Rechenberg wrote: > Yes, from prod-eagle.appspot.com to prod-eagle.appspot.com > > -A > > On Jul 29, 2011 7:18 PM, "Jon Mc

Re: [google-appengine] Is HTTP_X_APPENGINE_INBOUND_APPID authenticated?

2011-07-29 Thread Andrin von Rechenberg
Yes, from prod-eagle.appspot.com to prod-eagle.appspot.com -A On Jul 29, 2011 7:18 PM, "Jon McAlister" wrote: > Right now it's only being sent when the request is to an appspot.com > url. Is that the case in your example? > > On Fri, Jul 29, 2011 at 9:40 AM, MiuMeet Support wrote: >> Why isn't t

Re: [google-appengine] Is HTTP_X_APPENGINE_INBOUND_APPID authenticated?

2011-07-29 Thread Jon McAlister
Right now it's only being sent when the request is to an appspot.com url. Is that the case in your example? On Fri, Jul 29, 2011 at 9:40 AM, MiuMeet Support wrote: > Why isn't this header present if I call my own app from my app? > I'm trying to build an appengine lib that will interact with an a

Re: [google-appengine] Is HTTP_X_APPENGINE_INBOUND_APPID authenticated?

2011-07-29 Thread MiuMeet Support
Why isn't this header present if I call my own app from my app? I'm trying to build an appengine lib that will interact with an appengine app, but if that appengine app uses the lib too, the headers will be missing... :( Cheers :) -Andrin On Tue, Jul 26, 2011 at 5:24 PM, Jon McAlister wrote: >

Re: [google-appengine] Is HTTP_X_APPENGINE_INBOUND_APPID authenticated?

2011-07-26 Thread Jon McAlister
I should also point out that, while this header is not yet documented, it's not going away either, and will be documented in an upcoming release. On Tue, Jul 26, 2011 at 8:23 AM, Jon McAlister wrote: > Yes, you can assume this. > > The only cases where this header will be allowed through to the a

Re: [google-appengine] Is HTTP_X_APPENGINE_INBOUND_APPID authenticated?

2011-07-26 Thread Jon McAlister
Yes, you can assume this. The only cases where this header will be allowed through to the app are: (a) another app is requesting your app using our urlfetch api [or, the app is urlfetching itself] (b) the request came from a logged-in admin of your app While (a) is the primary intention o

[google-appengine] Is HTTP_X_APPENGINE_INBOUND_APPID authenticated?

2011-07-26 Thread Andrin von Rechenberg
Hey there I was wondering if the header HTTP_X_APPENGINE_INBOUND_APPID could be faked by a client or if the Google Frontends authenticate this header somehow? Is it secure to assume that if HTTP_X_APPENGINE_INBOUND_APPID is present, the request is really from that app? Cheers, -Andrin -- You r