将Google Apps脚本网络应用限制为仅限某些用户 [英] Limiting Google Apps Script Web app to certain users only

问题描述

制作一个可更改我的Google云端硬盘中某些(表格)文件的网络应用程序(即用户将以我的身份使用该应用程序)，但我想限制该网络应用程序的访问权限仅针对某些用户.部署应用程序时，我只能选择将其设为私有或公开.一种解决方案是使用会话类查看是否登录了正确的用户.

Making a web app that makes changes to certain (Sheets) files on my Google Drive (i.e. user will use the app as me), but I would like to restrict the Web app access only to certain users. When deploying app, I only have the options of making it private or public. One solution would be to use the session class to see if a correct user is logged in.

function onAppBegin(){

 if (Session.getActiveUser().getEmail() != "[e-mail]") return null;
 accessGranted();
}

但是，我担心这种粗略的方法是否真的安全并且不可以被黑客入侵?

However, I am concerned if this crude method is actually safe and is not hackable?

推荐答案

该方法太安全:没有人可以访问.如果您的Web应用程序部署时带有以我的身份执行应用程序"选项，则 Session.getActiveUser().getEmail()可能会返回空字符串.请参见文档:

The method is too safe: nobody will have access. If your web app is deployed with the option "Execute the app as: me", then Session.getActiveUser().getEmail() will probably return the empty string. See documentation:

可用的电子邮件地址的情况各不相同:例如，在允许未经用户授权运行脚本的任何情况下，用户的电子邮件地址都不可用，例如部署到以我的身份执行"(即由开发人员而非用户授权).但是，如果开发人员和用户属于同一个G Suite域，这些限制通常将不适用.

The circumstances in which the email address is available vary: for example, the user's email address is not available in any context that allows a script to run without that user's authorization, like [...] a web app deployed to "execute as me" (that is, authorized by the developer instead of the user). However, these restrictions generally do not apply if the developer and the user belong to the same G Suite domain.

问题是，即使用户登录访问该Web应用程序，他们也没有授权它代表他们执行任何操作，例如，找到他们的电子邮件地址.

The issue is that even though the user logged in to access the web app, they did not authorize it to do anything on their behalf, e.g., find their email address.

如果将Web应用程序部署为由用户访问Web应用程序"执行，则将要求他们对其进行授权，因此Web应用程序可以了解其身份.但是，那么它将只能修改用户已经可以直接修改的那些文件.

If the web app is deployed to be executed by "User accessing the web app", then they will be asked to authorize it, and so the web app can learn their identity. But then, it will only be able to modify those files that the user already can modify directly.

解决此问题的方法是为授权用户提供Web应用程序的密钥(一些长的随机字符串).他们通过访问 https://..../exec?key = mykey 来访问该应用程序，然后该应用程序按以下方式检查密钥:

The way I get around this difficulty is by giving the authorized users a key to the web app (some long random string). They access the app by going to https://..../exec?key=mykey, and the app checks the key as follows:

function doGet(e) {
  if (e.parameter.key == "mykey") {
    var ss = SpreadsheetApp.openById("spreadsheet Id");  
    // modify the spreadsheet
  }
}

现在，这比您的原始方法还要粗糙，但可以.如果错误的人获取了密钥，他们将能够使用该应用程序，但损害将仅限于该应用程序可以做什么.这并不比有人可以访问您的Google帐户那么糟糕.

Now, this is even more crude than your original approach, but it works. If a wrong person gets the key, they will be able to use the app but the damage will be limited to what the app can do. It's not nearly as bad as someone getting access to your Google Account.

这篇关于将Google Apps脚本网络应用限制为仅限某些用户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！