Problems with UserService in Google Engine

Question

I am trying to write an application for the Google engine that will be available only to me. (I know this sounds weird ... for now). I am trying to write a login servlet that will authenticate a user using Google UserService and allow the user to log into the application only if I log in and show a short message asking everyone else to log out.

Here is the code I wrote:

public class MainPageServlet extends HttpServlet { public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException { resp.setHeader("Cache-Control", "no-store, no-cache, must-revalidate"); resp.setContentType("text/html"); UserService userService = UserServiceFactory.getUserService(); User user = userService.getCurrentUser(); if (user != null) { if(user.getEmail().equals(" [e-mail] ")) { resp.getWriter().println("done"); } else { resp.getWriter().println("Hello, " + user.getNickname()+"<br>"); resp.getWriter().println("Thanks for your interest. But this application is still not available to everybody."); resp.getWriter().println("<a href="+UserServiceFactory.getUserService().createLogoutURL(userService.createLoginURL(req.getRequestURI()))+">Log out</a>"); } } else { resp.sendRedirect(userService.createLoginURL(req.getRequestURI())); } } 

}

The code associated with the "distillation" of all other users works fine. But I ran into problems when logging in: after logging in, it displays a “done” message, as expected. However, after that, if I open some other google service and exit it and call this servlet again, it will still display the message “done”. I expected the application to prompt me to log in again. This is not happening. I thought this was happening because the result is cached and caching is disabled (the 1st line in the method) so ... but the problem persists even after that ... is something wrong? How to get the expected behavior?

Answer 1

Not. If you want the user to log out, you need to log out of your service (you call the logout method from UserManager). The fact that they share the username and password with other google services does not mean that exiting these other services will automatically register them from yours.

Answer 2

I'm not sure about this, but when you first log in to the appengine app, you must grant privileges to access your profile information (I think this is the OAuth standard). You can limit this to the number of days. After that, the page can automatically read your email, nickname and Google ID before the expiration of the access period.

To get around this, you need to implement your own session mechanism and use the google login only to retrieve the userId (and from this internal profile object) to start the session (aka. Login).

If you want to log out of your page only, you just kill the session and do not log out of google user account