Avoid using db.UserProperty() when storing user ob

Question

Edit 08/01/2014

As of this edit time I realised that the subject property db.UserProperty() is removed from the ndb datastore at least. Good!

---

So... There is the db.UserProperty() model class that stores the Email address in Unicode order. Why and how does it differ from a unicode string that just stores the

users.get_current_user().email() 

in a db.StringProperty() lets say?

Is it safe to use it like:

class LocalUser(db.Model):

    user_account = db.UserProperty()

my_local_user = LocalUser.all().filter("user_account=", users.get_current_user().get())

EDIT

The reason that I asked this question is because many examples and some books for Google App Engine use db.UserProperty() for Models in order to save the user instance and later on when the user comes back they can get the db.Model instance for that specific user.

In my opinion this opens vulnerabilities in your application's users validation.

The answer from @RocketDonkey explains the roots of my query and gives a good explanation on why not store db.UserProperty() User object instances for storing user authentication.

The correct way is to store the user_id() property of the User instance because it is unique and fixed for every user.

P.S. Sorry for my english. If someone can edit, it will be appreciated.

Answer 1

Edit: As indicated by the documentation on User objects:

Both the db and NDB libraries have UserProperty property types so that applications can store user values. However, since these values become invalid when users change email address, most applications have no good use for this feature.

User instances are always unique and can be compared, but since they are represented in the datastore as the unique user_id (which will always be unique) and the user's email address, a user changing their email address will render the comparison useless (this is also indicated in the docs as another reason not to store it). Getting back to your original question (uses of db.UserProperty), this seems to indicate that for most situations, there is not a valid reason to store User instances in the datastore (I'll update this if I do come across a reason).