google-app-engine - 如何在我的 App Engine 中只允许内部 (cron) 请求

Question

目前我正在使用 nodejs App Engine(灵活环境)来执行计划任务，例如关闭和启动实例或创建快照。问题是这些 App Engines 可以从任何地方访问，但我只希望它们可以在我的谷歌云网络中访问。我似乎真的无法让防火墙以这种方式工作。有谁知道是否有办法做到这一点？

Answer 1

要强制仅在 Google 云网络内触发 cron 作业，您可以检查请求的 X-Appengine-Cron: true header ，客户端 IP 为 0.1.0.1.

来自 documentation :

You might want to validate that requests to your cron URLs are coming from App Engine and not from another source. You can do so by validating an HTTP header and the source IP address for the request:

• Requests from the Cron Service will also contain a HTTP header:

  X-Appengine-Cron: true

The X-Appengine-Cron header is set internally by Google App Engine. If your request handler finds this header it can trust that the request is a cron request. The X- headers are stripped by App Engine when they originate from external sources so that you can trust this header.

• Google App Engine issues cron requests from the IP address 0.1.0.1