Search code examples
google-app-enginegoogle-cloud-platformgoogle-tasksgoogle-cloud-tasks

How to secure an app engine app to be available only to Google Cloud Task?

I would like to create a task handler that is supposed to deal with some tasks with retry, etc.

But I want this endpoint to only be triggerable by a specific queue in google task ?

How am I supposed to deal with it ? What is the best practice ?

Best regards

Solution

  • UPDATE: Check Will's comment. This answer might be outdated and no longer work. Before applying it, be sure to test extensively.

    According to the Cloud Tasks documentation, requests incoming from Cloud Tasks will have the X-AppEngine-QueueName header.

    This header does not appear listed in the GAE docs about requests headers removed, but I just tested it and this header is also removed.

    To secure your GAE app to only be called through Cloud Tasks, validate that the X-AppEngine-QueueName header is in one of the approved queues that you want to allow to call your app.