About a month ago, I mentioned in
a post about multiplexing that -- since a single App Engine application can be bound to many domains -- a developer can leverage this knowledge to run several applications from the same app id or even run the same app within several namespaces (see my shortlinker running at
aef.appspot.com and
links.appenginefan.com). Unfortunately, I forgot to mention the darker side of this App Engine Feature: site hijacking.
Suppose you have a cool application at "mySuperDuperCoolApp.foo" that you expect to make you lots of money once it has a broad fanbase. Unfortunately, a couple of people discover your app-id on appspot.com and decide to "link" your app into their own site. Suddenly, your app is hosted at a multitude of domains that you do not own. Not only does this dillute the strength of the mySuperDuperCoolApp.foo brand -- it also enables the hijackers to point the url someplace else at a later point in time and steal your users (once they have all your features cloned). That's unacceptabe!
The following script (I call it "linksteal.py") is an example how this can be circumvented. The script assumes that you are using the webapp framework, but it could easily be adapted to the framework of your choice. Just import it in all your handler-scripts and you should be fine:
from google.appengine.ext import webapp
# A list of domains that are permissible
ALLOWED_DOMAINS = ('localhost', 'aef.appspot.com')
# The main domain of this application
MAIN_DOMAIN = 'aef.appspot.com'
# The original __call-- method, replace wih our own
original_call = webapp.WSGIApplication.__call__
# The new call method that checks the domain first
def new_call(self, environ, start_response):
if environ['SERVER_NAME'] in ALLOWED_DOMAINS:
return original_call(self, environ, start_response)
start_response('403 Invalid URL (content stolen?)',
[('Content-type', 'text/html')])
return ["""<html><body>
The URL requested belongs to a site that should not
be accessible through this domain. Please go to
<a href="%s">%s</a> instead.
</body></html>""" % (MAIN_DOMAIN, MAIN_DOMAIN)]
webapp.WSGIApplication.__call__ = new_call
So, how does this exactly work? In
ALLOWED_DOMAINS, we specify a list of domains that are "legal" hosts of our application (localhost is included to make the local dev server work).
MAIN_DOMAIN is the name of the main domain that we should refer users to that clicked on a "stolen link". We monkey-patch the WSGIApplication to wrap the original __call__-method with a check of the server-name. If the servername is in the permitted list, we call the original handler (and thus the code we wrote). Otherwise, we return a 403 and refer the user to the
MAIN_DOMAIN.By the way: this script can also be used to disable the hosting of the app at "appspot.com". Just take it out of the list of
ALLOWED_DOMAINS.
