Secure remote_api in app engine with OpenID

Question

I previously asked a question about using app engine's remote_api with openID, and the answer worked well, both securely and insecurely. At some point soon after, however, something in app engine changed, and the solution no longer worked securely - i.e. the following

remote_api_stub.ConfigureRemoteDatastore(app_id=app_id, path='/remote_api', auth_func=auth_func, servername=host, secure=True)

stopped working (always returning 302), and I needed to remove the secure argument to get it to work.

The release of the 1.3.5 SDK promised 'Remote API commands can be sent over HTTPS or HTTP', which confused me, as I was under the impression that providing the 'secure=True' argument had been giving me this already, based on this discussion.

My suspicion is that it was the release of this feature that caused the 'secure' argument to stop working. So the first part of my question - was I actually running remote_api commands securely by using the 'secure=True' argument, prior to the release of 1.3.5?

Once the cookie hack stopped working securely, I tried out Nick Johnson's solution listed in the same question, but with this also, I could not supply 'secure=True', getting the same 302 response.

What do I need to do to run remote_api securely with openID? Does 1.3.5 include new capabilities around this, and how do I use them? Cheers,

Colin

question from:https://stackoverflow.com/questions/3226880/secure-remote-api-in-app-engine-with-openid

Answer 1

Waitting for answers