Restricting access to administration features
Access to the administration features should be restricted to approved users, which means implementing authentication and authorization. The application already has support to identify users, using Google accounts, and the quickest way to restrict access is to configure the application to restrict access to a predefined list of accounts.
Note
Using OAuth to authenticate administrators is a useful way to identify users, but care should be taken in real projects to ensure some form of administration access if the OAuth service is unavailable.
To start, navigate to https://console.developers.google.com, click Credentials, and select the Edit OAuth Client action, which is represented by the pencil icon, as shown in Figure 20.10.
Figure 20.10: Editing the OAuth client
Add the following URLs to the Authorized redirect URIs section:
http://localhost:5000/auth-signin-googlehttps://localhost...
