Google App Engine inter module communication authorization

Question

In the Google Docs it says

You can configure any manual or basic scaling module to accept requests from other modules in your app by restricting its h

Answer 1

I can confirm this is occurring, and I've reproduced the issue. The issue is being tracked over in the App Engine public issue tracker. Follow there for any updates.

For now, I think it's much better to be manually-inspecting the X-Appengine-Inbound-Appid header, as this is managed by the infrastructure and can't be spoofed.

You could also implement OAuth, but that adds overhead you may not want or need on a small app.