Question

I am attempting to use appengine’s blobstore to store and access files securely. This files must only be accessible by members of the group that the file belongs to. I am implementing a access control by group in the datastore by looking up the member’s group and the allow access to the entity if the entity is part of the group, which is just stored as a field in the entity. How can this be implemented in the blobstore?? There does not seem to be any metadata stored with the blobs, except the filename if the File Api is used.

I am going to serve the blobs through a servlet and want to check the members account before serving blob. Any ideas???

Answer 1

Blobstore access goes always through your servlet. You can implement your access control before calling blobstoreService.serve(..).