title: Authentication on Google App Engine (web page)
body: <p>I would like to require the user to use a <strong>login/password</strong> when accessing some parts of my <strong>GAE</strong> (Google App Engine) application. I want to limit the access to the set of predefined users, e.g. on the page, where new data can be uploaded to the Datastore.</p>
  
  <p>I found there are 3 ways on GAE how this can be solved, but it looks like only the last one (the most complicated) could be a solution for my issue:</p>
  
  <ol>
  <li><p>Use a deployment descriptor (<strong><code>&lt;security-constraint&gt;</code> in web.xml</strong>). This is not nice, since those users have access, even as viewers to the GAE application's admin page, where they can see the billing history, browse Datastore, logs, etc. and this is something I have to avoid.</p></li>
  <li><p>Use the federated login (<strong>Open ID</strong>) (<a href="https://developers.google.com/appengine/articles/openid" rel="noreferrer">https://developers.google.com/appengine/articles/openid</a>) and allow users to use their Google, Yahoo! or other identities to login. It is not a solution, since I want to limit the access to a small set of users (max. 5) and not allow everybody to use the application.</p></li>
  <li><p>The other option is to create simple <strong>custom login page</strong> accessible only via HTTPS and let the user send the username &amp; password in a POST request (it can be plain since we have secure <strong>https</strong> connection) to a servlet, on the servlet generate some <strong>session identifier</strong> with specified validity and make it part of every subsequent request. It also needs to check each time the user sends a GET or POST request if the session identifier exists and does not expire meanwhile manually.</p></li>
  </ol>
  
  <p>Any other/better proposals on how to maintain administrator accounts? Can <code>HttpSession</code> help with the last variant?</p>
  
  <p>Kind Regards,
  STeN</p>