title: Web site login in Java + Google App Engine
body: <p>I am new to web programming, coming from a video game development background (c++), and am really starting to feel information overload.  There are so many competing libraries which all pick something they don't like in some other library, and build an entirely new way of doing the same thing!  I am sure there there are good reasons for this, and I don't want to complain, so I'll explain my problem.</p>
  
  <p>To ease my journey, I've decided to start learning Google App Engine + GWT + Java.  I like it because it's a distributed server architecture out of the box, and I've chosen Java because of my C++ background.</p>
  
  <p>To begin with I wrote little Twitter-like application because it tests various aspects of web development, namely: REST, JSON parsing/creation, AJAX comms, and HTML generation.  It didn't take me too long to create a little site that allows a user to enter their name and password into page in the browser, send the data across to my app, I login on their behalf, grab their friends list, and emit it back to the client as JSON, where I parse it and display it.</p>
  
  <p>Pretty simple stuff.</p>
  
  <p>So, the next step was that I didn't like sending the password the user has entered over the network as plain text (obviously).  That got me thinking about all the plumbing I would need:</p>
  
  <ol>
  <li>Authenticate users against my own database, not Google's. (Login/Lost password/Logout)</li>
  <li>Enter/exit (track) a session (logged in/logged out).</li>
  <li>Store user data in my Google app's database.</li>
  </ol>
  
  <p>All pretty standard stuff that's been around forever.  Well I started looking around for a Java authentication library and there were such large, monolithic libraries with huge learning curves, and some are old or not in favour any more...  I feel like a total beginner programmer all over again!  I just want to have a login page! :)</p>
  
  <p>So then I started reading up on how the plumbing of authentication works, and there is a huge amount to take in.  Apparently it's quite common for people to (insecurely) roll their own.  I'd rather take a solution that exists and is solid.</p>
  
  <p>So the question becomes, what do people do about this?  Twitter supports both HTTP and HTTPS, but defaults to HTTP for its REST API, does that mean people's passwords are flying around unprotected, ready to be intercepted by man-on-the-middle hacks?</p>
  
  <p>I also looked at OAuth, which looks excellent, but it doesn't have a case for just a good old "I don't want know or care what OpenID is".  Non technical people I've showed OpenID to are like "wha?  I just want to put my username/password in".</p>
  
  <p>As a side note, has anyone had any luck with Spring.Security on Google App Engine?</p>
  
  <p>Anyway, I'm ranting.  I just want to know what people do (not in Python, Rails etc, but in good old Java).  I'd love to have a login page like Digg, with even an option one day for OpenID :)</p>
  
  <p>Cheers,
  Shane</p>