App Engine Credential issue - google-app-engine

Question

I have an app engine app which imports a jar. In that jar I am using
GoogleClientSecrets.load()
to load client_secrets.json file for authentication with BigQuery. Apparently, App Engine does not like me reading a file from some location on my disk when I deploy the app on localhost. I am assuming if I put the credentials in WEBINF folder it will work but haven't tested it but then it would be easy for anyone to access the file. Where is the best place to put credentials and how would one access them from App Engine app?
Thank you for your help!
The suggestions helped to solve the problem when it comes to reading a file. What about writing to a file? I am using FileCredentialStore which stores credential file.
I believe this line is causing a problem:
FileCredentialStore variantStoreCredentialManager = new FileCredentialStore(expectedClientFile,jsonFactory);
and the error is
java.security.AccessControlException: access denied ("java.io.FilePermission" file path "write")
public Bigquery createAuthorizedClient() throws IOException {
Credential authorization = new GoogleCredential();
if ( clientID == null ) {
authorization = createWebAuthenticatedClientCredential();
} else {
String expectedFileLocation = CREDENTIAL_FILE_PATH;
File expectedClientFile = new File(expectedFileLocation);
if ( ! expectedClientFile.exists() ) {
// this is a known issue, the credential store will blow up if the file doesn't exist. So create it with an
// empty json ( { } )
createClientFile(expectedClientFile);
}
FileCredentialStore variantStoreCredentialManager = new FileCredentialStore(expectedClientFile,jsonFactory);
GoogleCredential.Builder credentialBuilder = new GoogleCredential.Builder();
credentialBuilder.setJsonFactory(jsonFactory);
credentialBuilder.setClientSecrets(clientSecrets);
credentialBuilder.setTransport(transport);
authorization = credentialBuilder.build();
boolean loadedSuccessfully = variantStoreCredentialManager.load(clientID,authorization);
if ( ! loadedSuccessfully ) {
authorization = createWebAuthenticatedClientCredential();
variantStoreCredentialManager.store(clientID, authorization);
}
}
return new Bigquery(transport, jsonFactory, authorization);
}

Answer 1

No, contents of /WEB-INF folder is private to application code and is not accessible via HTTP (= servlet container does not honour requests that try to access data in WEB-INF folder).
Use this snippet to read contents of a file inside a /WEB-INF folder:
InputStream is = getServletContext().getResourceAsStream("/WEB-INF/"+filename);
Then read a stream using one of the methods for reading InputStreams.