15

Making a web app that makes changes to certain (Sheets) files on my Google Drive (i.e. user will use the app as me), but I would like to restrict the Web app access only to certain users. When deploying app, I only have the options of making it private or public. One solution would be to use the session class to see if a correct user is logged in.

function onAppBegin(){

 if (Session.getActiveUser().getEmail() != "[email protected]") return null;
 accessGranted();
}

However, I am concerned if this crude method is actually safe and is not hackable?

2
  • Hi, for my project I need an answer to the same question you have asked. (The accepted answer is rather a workaround, not too safe - the key can be stolen easily.) Have you by chance found an answer later? Or a better solution?
    – Tom
    Apr 18, 2020 at 15:44
  • @Tom it's been ages since this project. But I wasn't able to find any other way Apr 19, 2020 at 17:18

2 Answers 2

6

The method is too safe: nobody will have access. If your web app is deployed with the option "Execute the app as: me", then Session.getActiveUser().getEmail() will probably return the empty string. See documentation:

The circumstances in which the email address is available vary: for example, the user's email address is not available in any context that allows a script to run without that user's authorization, like [...] a web app deployed to "execute as me" (that is, authorized by the developer instead of the user). However, these restrictions generally do not apply if the developer and the user belong to the same G Suite domain.

The issue is that even though the user logged in to access the web app, they did not authorize it to do anything on their behalf, e.g., find their email address.

If the web app is deployed to be executed by "User accessing the web app", then they will be asked to authorize it, and so the web app can learn their identity. But then, it will only be able to modify those files that the user already can modify directly.

The way I get around this difficulty is by giving the authorized users a key to the web app (some long random string). They access the app by going to https://..../exec?key=mykey, and the app checks the key as follows:

function doGet(e) {
  if (e.parameter.key == "mykey") {
    var ss = SpreadsheetApp.openById("spreadsheet Id");  
    // modify the spreadsheet
  }
}

Now, this is even more crude than your original approach, but it works. If a wrong person gets the key, they will be able to use the app but the damage will be limited to what the app can do. It's not nearly as bad as someone getting access to your Google Account.

1
  • 1
    I've tried the method Zeeshan Ahmad wrote in a different manner. App asks for grant to use Sessionfunctionnality. if user's says no then it returns nothing if user says yes then mail is checked and if it's a wrong mail then it returns ("invalid mail"). Does it make sense. Do you see security issues with method?? Thanks in advance
    – JSmith
    Oct 18, 2018 at 22:32
1

Combining the two ideas works great.

Checking to make sure it's the right user, and requiring a key.

If not both are correct it displays a no access page, instead of the real page.

function doGet(e) {

  if (Session.getActiveUser().getEmail() != "[email protected]") {
    var t = HtmlService.createTemplateFromFile("pageNoKey");
    return t.evaluate().setTitle("userDelegation No Access");

  } else if (e.parameter.key == "SomeKeyHere") {
    var t = HtmlService.createTemplateFromFile("page");
    return t.evaluate().setTitle("PageTitle");
  }

  var t = HtmlService.createTemplateFromFile("pageNoKey");
  return t.evaluate().setTitle("PageTitle No Access");
  }

function include(filename) {
  return HtmlService.createHtmlOutputFromFile(filename).getContent();
}

My code can probably be improved. I'm still learning. (Maybe validate both values in the first if loop?)

Anyway, this is what I'm using to restrict access to users managing Gmail delegation, using my free tool userDelegation. Since it's powered by a service account with domain wide rights, it needs to be locked down hard.

If you want a really flexible solution, check out this video, where the validation is done based on what type of access users have to a specific Google Doc! That was unnecessarily complex for my situation, as I only needed to restrict access to a single person accessing my web app. I will instead create separate versions of the same web app, and give each admin their own.

If you need an easy way to restrict your web app to several people, then that method might be just right for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.