Question

On March 1, 2011 App Engine changed its login flow, breaking my app (see the
Google Groups message). This issue also came up in this Stack
Overflow question. The suggested answers are

“have the app perform the redirect. That is, createLoginUrl only works when the
continue url is a url for the app. If you need the user to be sent to
another app/host after login, then your app needs to do that redirect”

and

“set up a redirect handler on your own app. Make that the target
of the continue parameter, and have it send a final redirect to your
actual target”.

I’m asking this question to get details on how to make this work. My application consists of two GAE apps, a GWT front end and the back end exposing a REST
API. Here is the current flow.

The user browses to http://my-front.appspot.com/, and the GWT makes a
JSONP call to a http://my-back.appspot.com/User servlet.

The /User servlet checks the GAE
UserServiceFactory.getUserService().getCurrentUser() to see if it’s
null. For users not logged in, this is null, and the servlet returns
JSONP that the user is not logged in.

The GWT code gets the “not logged in” message, and does

String login = "http://my-back.appspot.com/Login";
Window.open(login, "_self", "");

The Login servlet:

public void doActualGet(HttpServletRequest req, HttpServletResponse resp) 
    throws ServletException, IOException {

    UserService userService = UserServiceFactory.getUserService();
    String url = "http://my-back.appspot.com/LoginRedirectServlet";
    // String url ="http://my-front.appspot.com";  <--------- Before 1 March
    log.info("Auth then redirect to: " + url);
    String redirect = userService.createLoginURL(url);
    resp.setStatus(301);
    resp.setHeader("Location", redirect);
    resp.setHeader("Connection", "close");
}

My new LoginRedirectServlet has one line:

resp.sendRedirect("http://my-front.appspot.com/");

This usually results in a redirect loop, though sometimes after hitting the initial url several times it works. My suspicion is that there’s something wrong about the code near Window.open, but I’m open to all suggestions.

Thanks,
Glenn

Answer 1

Credit due to Nick Johnson for whining about the two-app architecture. I’ve never liked it. I moved war/MyFront.html and the compiled GWT code in war/myfront/ to the war file of the myback project, changed all urls to the form http://my-back.appspot.com/ and deployed. It worked!

This is just a hack, but it proves the principle.