Re: [google-appengine] security in task queue servlets

2010-02-02 Thread Eli Jones
The only thing to look out for when naming Tasks is.. Task names are unique for a certain time period (I think its 7 days [I'm writing this on my phone so I won't be verifying that :) ]). This makes sure a task with the same name doesn't get added to the queue twice due to any errors. On 2/2/10,

Re: [google-appengine] security in task queue servlets

2010-02-01 Thread Patrick Twohig
I believe that the App Engine injects the pertinent information from the Users service. For instance, when you call HttpServletRequest.getUserPrinicpal(), you're getting values injected by the UsersService. On Mon, Feb 1, 2010 at 11:02 AM, Eli Jones wrote: > If you have a compelling reason for

Re: [google-appengine] security in task queue servlets

2010-02-01 Thread Eli Jones
If you have a compelling reason for really locking down the task queue url (and Require Admin login isn't enough), you could create a mechanism that creates a task name for each queued task.. and the task verifies that its name is "correct". You could have the task use the X-AppEngine-TaskName hea

[google-appengine] security in task queue servlets

2010-01-31 Thread Patrick Linskey
Hi, I'd like to programmatically ensure that my task queue servlets are only invoked via the task queue. I've got a security constraint in my web.xml, but I'd like to also check in code to avoid any potential mis- configuration in the future. Is there any supported means to do such a check? I tr