Google App Script - Why is getTemporaryActiveUserKey() returning the same value for unique users

user_10337599 0
Viewed 1092

I have created a contact type form using Google App script and published as a Web App.

As I need to determine that the users filling in the form are unique I have used the getTemporaryActiveUserKey() function to get the users unique key and save it to a spreadsheet alongside the rest of the form data.

However there has now been a number of instances where the script has returned the identical key for multiple different users. I know for a fact these users are using different browsers and are in completely different locations.

My question is, how is this possible?

Below is the function in code.gs which runs when the form is submitted which retrieves this value

function postFormDataToSheet(form){
  var responseSheet = SSDoc.getSheetByName("Results");

  var time = new Date()

  var userKey = Session.getTemporaryActiveUserKey();
  var resultRow = [time,form.user_name, form.user_email, form.sheet,userKey]
  responseSheet.appendRow(resultRow);
}

And the JavaScript Function in the Form HTML which calls the above Function when the submit button is pressed

$(function(){
  $('#submitButton').on('click', function(){
    google.script.run.withSuccessHandler(SuccessPage).postFormDataToSheet(this.form);    
  })
})

Webapp is published with the following settings

Execute the app as: Me (myemailaddress)

Who has access to the app: Anyone, even anonymous
google-apps-script
2 Answers

After a lot of research and trialling various scenarios I have determined the following:

  • The getTemporaryActiveUserKey() function will return a unique key for any user logged in with a google account ( Known as an ActiveUser )
  • If the user is not logged into a google account (or is using an incognito session) then getTemporaryActiveUserKey() still returns a key value BUT this is not unique to that user. This was the cause of the duplicate key I was receiving.
  • To ensure ONLY unique keys are returned when publishing the web app it should be publish with the requirement that a user is logged in to access it.

Based on the above my opinion is that the getTemporaryActiveUserKey() function should not return a value at all for users that are not logged in as I cannot see any use for such a key when is not unique to the user.

user_103375990

Your web app deployed with permission "Execute the app as me", it means the script always executes as you.

From documentation of Session.getTemporaryActiveUserKey():

Gets a temporary key that is unique to the active user but does not reveal the user identity. The temporary key rotates every 30 days and is unique to the script.

As it based on active user, you will get the same result every time because for Google Apps Script you are the only active user for web app script, despite of who do request to the script.

If you want to be able to get different values for different users, you will need to ensure users are authorized, by using web app permission setting "Execute the app as user accessing the web app".

user_5551210
Related