GAE self.request.cookies return an empty dict

Question

I'm trying to override CheckIsAdmin method present in ApiCallHandler class. So I followed this answer. But I always get empty dict on printing self.request.cookies.

At some point I get the values on printing self.request.cookies but not it won't. I have checked that my server is running and I'm already looged in.

remote_api.py looks like

import re
import models
from google.appengine.ext.remote_api import handler
from google.appengine.ext import webapp

MY_SECRET_KEY = '[e-mail]'  # make one up, use the same one in the shell command


class ApiCallHandler(handler.ApiCallHandler):

    def CheckIsAdmin(self):
        '''
        Determine if admin access should be granted based on the
        auth cookie passed with the request.
        '''

        '''
        print 'App id ' + models.APPLICATION_ID
        print 'on checkIsAdmin'
        print 'request.cookies ' + str(self.request.cookies)
        login_cookie = self.request.cookies.get('dev_appserver_login', '')
        match = login_cookie.split(':')
        print 'headers '+ str(self.request.headers)
        if match and match[0] == MY_SECRET_KEY \
                and 'X-Appcfg-Api-Version' in self.request.headers:
            print 'Going to return true'
            return True

app = webapp.WSGIApplication([('.*', ApiCallHandler)])

part of app.yaml looks like

- url: /remoteapi.*
    script: api.remote_api.app

This is correct where my .py file exists inside api folder..

When I'have tried this command,

echo "[e-mail]" | appcfg.py upload_data --email=[e-mail] --passin --url=http://localhost:8080/remoteapi --num_threads=4  --db_filename=bulkloader.csv

it shows invalid parameter --passin and it works perfectly if I placed return True at the start of CheckIsAdmin method. But it lacks security..

Answer 1

It looks like they removed --passin and now exclusively rely on oauth.

https://code.google.com/p/googleappengine/wiki/SdkReleaseNotes#Version_1.9.24_-_July_20,_2015

--passin was the flag that caused cookies to get set. It looks like you will need to downgrade to an sdk version below 1.9.24 or change the command to use oauth and remove the custom ApiCallHandler code.