Appengine spoof User-Agent string

Question

I have an internal webservice that allows calls only from particular AppEngine application. I'm extracting AppId from User-Agent string however it looks like when I add it multiple times only one will be fixed by Google.

Is there a better way to recognize Appengine application?

My WS is hosted in my network, not at Google.

Answer 1

As per the App Engine documentation, an application can modify the User-Agent string but App Engine will append the Identifier String to the requests.

For e.g. "AppEngine-Google; (+http://code.google.com/appengine; appid: APPID)"

What do you mean by multiple User-Agent strings? Shouldn't it be just one, which is what AppEngine also appends to, even if you modify it ?

There are other Request Headers that the App cannot modify for security purposes, for e.g. refer to https://developers.google.com/appengine/docs/java/urlfetch/#Java_Request_headers but I am not sure if they are useful in your case.