Stormpath Python SDK on Google App Engine requires several workarounds

[jcjones1515]

I'm new to stormpath and building an application on GAE. I was able to manage to get it working, but not without quite a bit of frustration and workarounds (documented here: https://gist.github.com/jcjones1515/40a50594fcccd74bca49509f74f3d33a).

It would be helpful if there were some app engine specific documentation out there that was easily findable. There are quite a few old workarounds that come up through google that are misleading.

Also, the call to platform.platform() could be corrected to eliminate the need to monkey patch.

[rdegges]

This is a particularly annoying issue to me because it seems like Google goes out of their way to break app engine in every way possible. I had someone submit PRs to me to make our SDK work with app engine in the past, but it is such a pain to maintain their hacks.

They have several issues here:

1. You have to monkey patch using the requests library (which is an ugly solution, IMO).
2. You have to monkey path part of the standard library (platform), which is another ugly hack.
3. You have to disable security on our library by using basic auth instead of digest auth, because google is literally tampering with your http requests.

The whole thing is just horrible, IMO.

I'm still undecided as to whether or not I want to adopt these hacks into this library to support GAE, or just keep on explicitly not supporting it.

[jcjones1515]

With GAE (Standard Environment), you get to just worry about the code and let Google take care of the infrastructure of scaling at a very reasonable cost. Over 6+ years at 2 different startups I've found the value of that is hard to overstate.

The tradeoff of course is dealing with the quirks of the sandbox which are many (and sometimes quite annoying).

A potential alternative would be to run this in the Flexible Environment, but the costs (and additional effort involved) are not worth it to me (yet).

I'm not necessarily asking for anything to be incorporated into the SDK, but given the popularity of GAE it seems like some documentation of what's required to make it work would go a long ways.

[jcjones1515]

concerning item 3 above @rdegges, after a little tinkering I found that if you strip the 'User-Agent' and 'Accept-Encoding' headers (similar to the way you strip out Content-Length and Connection already) SAuthc1 seems to work just fine. I opened a PR for this change