How can I use "login: required" on a Google App Engine app using a custom domain? - google-app-engine

I have a Python GAE app on a custom domain. When I add login: required to any handler, the site redirects to the app's appspot.com domain instead of my custom domain. The functionality of the site isn't affected, and all handlers and routes continue to work as expected — just on the appspot.com domain instead.
Example snippet from the app.yaml below. mydomain.com works fine with the custom domain, mydomain.com/test and any other handlers redirect to the appspot.com domain after authentication (myapp.appspot.com/test).
- url: /
script: main.application
- url: /test
script: main.application
login: required
- url: /.*
script: main.application
login: required
Is this a configuration issue with how App Engine is handling the domain, or is this an issue with the redirect used by the login: required setting?

You need to set Authorized redirect URIs in your Developer Console (under API | Credentials) to your custom domain rather than the default appspot.com. So the requests coming from the custom domain would be 'called-back' to the custom domain as well.
Take a look on the attached screenshot on how this is configured for my application.
[]

Related

App Engine matching any "subdomain" to my service

I have a Strapi application on Google App Engine as the Default service.
The default URL App Engine generates is https://my-project.uc.r.appspot.com
When I create any other version for my default service or deploy another service, the new URLs would be something like: https://[identifier]-dot-my-project.uc.r.appspot.com
My problem is that if I replace [identifier] with anything at all it opens my Strapi Application root page.
I don't think this has anything to do with Strapi at all, it's probably a feature of App Engine.
My question is: How do I stop this from happening? I want only proper URLs to be matched. That is, if I create a "dev" version, I should be able to access it with the following URL: https://dev-dot-my-project.uc.r.appspot.com, but I don't want any other URL to be matched, like: https://12345-dot-my-project.uc.r.appspot.com
I am using a Standard Environment with the default app.yaml from Strapi docs
runtime: nodejs16
instance_class: F2
env_variables:
HOST: '0.0.0.0'
NODE_ENV: 'production'
DATABASE_NAME: 'strapi'
DATABASE_USER: 'postgres'
DATABASE_PASSWORD: '<password>'
INSTANCE_CONNECTION_NAME: '<instance_identifier>'
beta_settings:
cloud_sql_instances: '<instance_identifier>'
When the app is deployed to App Engine, the app.yaml is automatically modified to add some default params.
runtime: nodejs16
env: standard
instance_class: F2
handlers:
- url: .*
script: auto
I thought maybe this url: .* was the cause of this and tried to change it to url: /.* (Docs), but App Engine still add the url: .* again anyway at the end and it will have both handlers.
This is expected behavior. Per the documentation
If a request matches the PROJECT_ID.REGION_ID.r.appspot.com portion of the hostname, but includes a service, version, or instance name that does not exist, then the request is routed to the default service.
In your example, when you hit the url - https://12345-dot-my-project.uc.r.appspot.com and it turns out '12345' is not a valid version, the default service - https://my-project.uc.r.appspot.com will take over.
If you really want to block it, you'll have to write code to read the incoming url (i.e. the original url that came in), determine the version and if it's not in your list of versions, you raise an error (maybe return 404). This is basically what you'd do if you were offering a service built on GAE where each of your users had their own custom domain (version of your app) e.g. a blog hosting platform, an ecommerce site (like Shopify)

App Engine - subdomain pointing to particular service

I have two subdomains registered in my App Engine application:
service-a.my-app.com
service-b.my-app.com
I have added all the records (CNAME, A) on the server.
I have three services in my GAE:
default
service-a
service-b
And I want each subdomain to point to the correct service. However, each time I access them, only the default service is used.
Side note: the GAE is running a flexible environment for laravel 5.4 and my dispatch.yaml (located in default service is as follows:
dispatch:
-url: "service-a.my-app.com/*"
service: service-a
-url: "service-b.my-app.com/*"
service: service-b
This worked for me. Hope this helps someone.
GAE Standard:
I have an angular project which will load for any subdomain except one subdomain "api".
The backend is written in Go and all services are under a service named "api"
STEP1: Setting local env
Angular project has the following app.yaml
runtime: python27
api_version: 1
instance_class: F1
handlers:
- url: /
static_files: default/index.html
upload: default/index.html
- url: /
static_dir: default
My service.yaml file resides in a separate directory and has the following
runtime: go
api_version: go1
instance_class: F1
service: api
handlers:
- url: /.*
script: _go_app
secure: always
My dispatch.yaml has the following
dispatch:
- url: "api.MYDOMAINNAME.com/*"
service: api
//Add more subdomain : services mapping here
I deployed all these files using gcloud app deploy command
Step 2 - Configure Custom domains in GAE.
In GAE Console, goto Project Settings > Custom Domains
Add your domain
Verify your domainusing one of the methods provided by Google.
Update CNAME, A and AAA records in your domain service provider's DNS Settings
Step 3 - Configure Sub Domain
Add a subdomain api.MYDOMAINNAME.com
Add the CNAME in your domain service provider's settings.
// add more subdomains if required
Add a Wildcard subdomain *.MYDOMAINNAME.com
Add the CNAME in your domain service provider's settings to redirect * to google.
Finally:
Wait for few minutes for the settings to be applied.
Now your application will redirect MYDOMAINNAME.com, www.MYDOMAINNAME.com , *.MYDOMAINNAME.com to the Angular code
and
api.MYDOMAINNAME.com to your api service
Please note that dispatch.yaml is an app-level configuration, not a service-level one and occasionally updating the service containing it doesn't automatically update the app-level configs.
You should use the specific deployment commands for dispatch.yaml, executed from the directory containing the file:
gcloud app deploy dispatch.yaml if you're using the Cloud SDK
appcfg.py update_dispatch . if you're still using the GAE SDK
See also dispatch.yaml not getting updated.
The same is true for other app-level .yaml config files as well, which is probably one reason for each having its own update/deploy command (and also to allow deploying them independently of any particular app service. Somehow related: Why do I need to deploy a "default" app before I can deploy multiple services in GCP?
Actually the answer was really easy: You just need to map a wildcard subdomain and GAE would the use the service corresponding to the prefix.

App engine endpoints API - 404 with custom domain

I'm trying to use custom domain with app engine. Everything works fine with localhost and appspot url. But with custom domain endpoints api doesn't work; the API discovery request (https://cc.mdsarowar.me/_ah/api/discovery/v1/apis/conference/v1/rest) returns Not Found with error code 404.
Here is my app.yaml (full code):
- url: /_ah/spi/.*
script: conference.api
secure: optional
And endpoints api (full code):
#endpoints.api( name='conference',
version='v1',
allowed_client_ids=[WEB_CLIENT_ID, API_EXPLORER_CLIENT_ID],
scopes=[EMAIL_SCOPE], hostname = 'cc.mdsarowar.me')
class ConferenceApi(remote.Service):
"""Conference API v0.1"""
........
Thanks in advance.
As per the docs:
Note: Google Cloud Endpoints does not support custom domains.
Edit
There is an open feature request for this so you may want to star it.

App Engine Managed VM custom runtime app.yaml login: admin

I am trying to run a Jenkins server in a Docker container, as a GAE Managed VM 'custom runtime'
I want to use the app.yaml to enforce login: admin auth
Docs say:
It isn't necessary to define a handler stanza in your config file. If your application is serving only dynamic requests, the handler stanza can be omitted. If you want to set up a secure URL for dynamic requests, use login: admin with an otherwise empty handler.
If I don't define the handler stanza then Jenkins web UI works fine, but I have no auth on the url.
I have tried the following variations but they all lead to symptom where the Jenkins dashboard loads, but all static files are all broken and can't act because js not loaded
handlers:
- url: /.*
login: admin
handlers:
- login: admin
this is the working stanza:
handlers:
- url: /.*
script: dynamic
login: admin

wildcard domain redirect in app.yaml

I have already setup my DNS to point all sub domains to #, and I can tell that that is working because I am now getting an appengine error that the URL was not found on the server.
How can I setup my app.yaml file to catch and point all subdomains of my custom domain to the same static file?
Thanks!
Example:
http://learnnow.us
(works)
http://something.learnnow.us
(does not)
DNS Entry
name | type | data
* | CNAME | #
app.yaml
- url: /
static_files: index.html
upload: index\.html
- url: *
static_files: index.html
upload: index\.html
Since you have a Google Apps account, to map all sub-domains to your app you need to add your App in the App Engine Apps section of the Admin console for learnnow.us. Then you add a mapping *.learnnow.us and create a CNAME record for * pointing to ghs.googlehosted.com. It may also be possible to do it via Developers Console -> Your_App -> Compute -> App Engine -> Settings -> Custom Domains (didn't test it though).
Subdomain mapping is done on a DNS level. Configure this through the DNS service provider you have registered with. Map all subdomains to your main domain.
Route mapping is done in app.yaml. Once a request reaches your app, a route configuration in app.yaml with url: /.* will map all routes to that handler.
Given that your confusion about DNS mapping vs app.yaml route configuration should be cleared up, please accept this answer as valid. If you are experiencing other issues doing more complex things, as it seems from your comments, create a new question. Edits to your question should only contain more relevant info to the original question and comments should not introduce new questions.

Resources