title: User authentication & authorization using AngularJS + Firebase + Google App Engine
body: <p>I'm relatively new to web development, so I apologize if this question is a bit basic. I've been doing research for the past 3 hours on how to solve this issue that I think is very common. However, because I am not an expert, I am unable to tell whether my understanding is correct.</p>
  
  <p>In short, I am developing a simple web app in AngularJS, and using Google App Engine as my data store. I flirted with the idea of using Firebase as my data store, but I am strongly attached to certain Google App Engine features (mainly ability to query).</p>
  
  <p>In essence my site will have users. Users can create projects. Users can grant other users access to their projects. For a given project (with a given projectID), only certain users should be able to access it. Thus, an http.$get request to /rest/projects/[projectID] should only be able to be accessed by users with that projectID in their projects.</p>
  
  <p>Conceptually, from what I understand from my reading, the ideal scenario is if I have a user login system in Google App Engine that upon logging in, will send back a session token OR cookie. Then, whenever I make a request to the server from AngularJS, I will send this token/cookie through the HTTP headers. Then, my server can parse this cookie to understand what user it is, and from that figure out if the user should have access to a particular project.</p>
  
  <p>It seems that Google App Engine doesn't have an authentication system that allows for emails/passwords that are custom; in other words, I don't want to use App Engine's option of authenticating using a user's google account. I want users to be able to sign up using whatever email they have and whatever password they want.</p>
  
  <p>It turns out that Firebase has a SimpleLogin module that I can easily implement. However, the authentication token that I receive from Firebase can't really be used to implement security on Google App Engine right?</p>
  
  <p>Ultimately my question boils down to: Let's say I use Firebase's SimpleLogin to authenticate users and use the authentication token from FireBase's SimpleLogin to store whether a user is logged in. I can't use that token to enforce security to my data store (Google App Engine), right? </p>