Question

I have been learning Google AppEngine for a couple of weeks… now I am integrating it with Gwt for my web application.

The “guestbook” GAE tutorial is very interesting, if you know what I’m talking about.

I loved the so easy integration with Google Accounts, it’s very useful but…

my customer is not interested in it, he wants standard, classic authentication system.

So I’ll have my own “User” entity in the datastore, and so on. I can do that.

What I can’t do is creating my own UserService, for checking wherever in my App wheter the user is logged in or not.

I mean I’m not so good at manage Sessions, Cookies, or whatever is needed to achieve my goal. Can you help me with that?

Answer 1

If your only problem is to know if the user is logged in, the solution is straightforward.

In the authentication code, once the user is authenticated:

request.getSession().setAttribute("loggedIn", Boolean.TRUE);

Anywhere in the code:

boolean loggedIn = request.getSession().getAttribute("loggedIn") != null;

If you have a “Logout” action :

request.getSession().removeAttribute("loggedIn");

The attributes in the session are stored at server-side. They’re not sent as cookies to the client, so there’s no security risk.