java - 保存 oAuth 凭据

Question

我使用 Google 文档中的代码(如下所示)来管理 Google 日历。

public class CalendarQuickstart {
    private static final String APPLICATION_NAME = "Google Calendar API Java Quickstart";
    private static final JsonFactory JSON_FACTORY = JacksonFactory.getDefaultInstance();
    private static final String CREDENTIALS_FOLDER = "credentials"; // Directory to store user credentials.

    /**
     * Global instance of the scopes required by this quickstart.
     * If modifying these scopes, delete your previously saved credentials/ folder.
     */
    private static final List<String> SCOPES = Collections.singletonList(CalendarScopes.CALENDAR_READONLY);
    private static final String CLIENT_SECRET_DIR = "client_secret.json";

    /**
     * Creates an authorized Credential object.
     * @param HTTP_TRANSPORT The network HTTP Transport.
     * @return An authorized Credential object.
     * @throws IOException If there is no client_secret.
     */
    private static Credential getCredentials(final NetHttpTransport HTTP_TRANSPORT) throws IOException {
        // Load client secrets.
        InputStream in = CalendarQuickstart.class.getResourceAsStream(CLIENT_SECRET_DIR);
        GoogleClientSecrets clientSecrets = GoogleClientSecrets.load(JSON_FACTORY, new InputStreamReader(in));

        // Build flow and trigger user authorization request.
        GoogleAuthorizationCodeFlow flow = new GoogleAuthorizationCodeFlow.Builder(
                HTTP_TRANSPORT, JSON_FACTORY, clientSecrets, SCOPES)
                .setDataStoreFactory(new FileDataStoreFactory(new java.io.File(CREDENTIALS_FOLDER)))
                .setAccessType("offline")
                .build();
        return new AuthorizationCodeInstalledApp(flow, new LocalServerReceiver()).authorize("user");
    }

    public static void main(String... args) throws IOException, GeneralSecurityException {
        // Build a new authorized API client service.
        final NetHttpTransport HTTP_TRANSPORT = GoogleNetHttpTransport.newTrustedTransport();
        Calendar service = new Calendar.Builder(HTTP_TRANSPORT, JSON_FACTORY, getCredentials(HTTP_TRANSPORT))
                .setApplicationName(APPLICATION_NAME)
                .build();

        // List the next 10 events from the primary calendar.
        DateTime now = new DateTime(System.currentTimeMillis());
        Events events = service.events().list("primary")
                .setMaxResults(10)
                .setTimeMin(now)
                .setOrderBy("startTime")
                .setSingleEvents(true)
                .execute();
        List<Event> items = events.getItems();
        if (items.isEmpty()) {
            System.out.println("No upcoming events found.");
        } else {
            System.out.println("Upcoming events");
            for (Event event : items) {
                DateTime start = event.getStart().getDateTime();
                if (start == null) {
                    start = event.getStart().getDate();
                }
                System.out.printf("%s (%s)\n", event.getSummary(), start);
            }
        }
    }
}

我将其放入 Google App Engine 上的 Java 应用程序中。但是，该应用无法将凭据写入 credentials 目录，因为 App Engine 不允许写入磁盘。

解决这个问题的一个选择是编写 FileDataStoreFactory 的自定义实现并将凭据存储在 Google Bucket 中。这是推荐的方法吗？这样做安全吗？有更好的选择吗？

Answer 1

有一个页面专门用于使用 Google App Engine它还提到了如何使用 OAuth2Decorator 或 OAuth2DecoratorFromClientSecrets 连接到其他 Google API，例如 Google 日历。

The easiest way to handle OAuth 2.0 is to use the App Engine Python decorators supplied by this library. These decorators handle all of the OAuth 2.0 steps without you having to use any Flow, Credentials, or Storage objects.

There are two decorator classes to choose from:

OAuth2Decorator: Use the OAuth2Decorator class to contruct a decorator with your client ID and secret. OAuth2DecoratorFromClientSecrets: Use the OAuth2DecoratorFromClientSecrets class to contruct a decorator using a client_secrets.json file described in the flow_from_clientsecrets() section of the OAuth 2.0 page. There are also two decorator types to choose from:

oauth_required: Any method decorated with oauth_required completes all OAuth 2.0 steps before entering the function. Within the body of the function, you can use the decorator's http() function to get an Http object that has already been authorized. oauth_aware: This decorator type requires a little more code than oauth_required, but it is preferred because it gives you control over the user experience. For example, you can display a page explaining why the user is being redirected to an authorization server. This decorator does not perform any OAuth 2.0 steps, but within the body of the decorated function you can call these convenient decorator functions: has_credentials(): Returns True if there are valid access credentials for the logged in user. authorize_url(): Returns the first URL that starts the OAuth 2.0 steps.