2

I know how to write a web-app and publish it as myself. What I am trying to do is publish a web app so that it can access both my data and the users data.

For example, the web-app would read data from a Sheet that I own, and then add it to a Sheet the user owns.

I realize one approach is to make my sheet accessible by anyone with the link and have the web-app run in the user's context. When the user views the web-app it will run in the user's context so it can access their Sheet and Since my sheet is viewable by anyone with a link it will be able to access my Sheet.

However, I am trying to do this without making my sheet accessible by anyone with a link.

Is this possible?

Marios
  • 26,333
  • 8
  • 32
  • 52
IMTheNachoMan
  • 5,343
  • 5
  • 40
  • 89

1 Answers1

6

Workaround#1: Two web apps

Use two web apps and handle authentication between those two:

  • WebApp#1: API to access your sheet

    • Execute as "Me"
    • Access: "Anyone, even anonymous"
    • Handles incoming POST requests: checks for necessary authorizations, authenticates the request and returns data from sheet.

  • WebApp#2: User facing app

    • Execute as "User accessing the web app"
    • Access: "Anyone"
    • User requests data from your sheet> Client requests Server(google.script.run)> Server POSTs request along with necessary authorization headers using UrlFetchApp> receives and parses the sheet data and provides it to client.

  • Notes:

    • This set up security is only as strong as the authorization/authentication used between the web-apps.

Workaround#2: Client side Google sign in

Community
  • 1
  • 1
TheMaster
  • 45,448
  • 6
  • 62
  • 85
  • 2
    @IMTheNachoMan There is a 3rd (albeit more complex) option where you can leverage a Service Account to access your sheet without sacrificing privacy. The one downside is that this approach requires a GCP project. However, there might be a loophole you can exploit. A service account does not need to be tied to your company's GSuite domain so its possible to create a service account using a separate non-company account and use it in your project. Do you think that your company would be OK with that? – TheAddonDepot Sep 13 '19 at 00:23
  • @DimuDesigns No. I am pretty sure that would get me fired. But I will look into it. I have to find out how to create service accounts first. – IMTheNachoMan Sep 13 '19 at 03:00