I want to use a Google Apps Script web app to download data from a specific Google Forms. In order to avoid having to login to get the data, I want to specify that the web app runs as me, and is accessible from anonymous users.

If I then keep the URL of that web app to myself (except for using it to get the data through the HTTPS request), is it reasonable to assume that nobody else can use it?

In other words, is there enough randomness in the script's URL to make it safe to use for accessing private data?

I want to use this script in a program, but I don't want to figure out how to login programmatically.


1 Answer 1


As the post linked by Rubén calculates, there is plenty of entropy in the URL of a GAS web app. That post considers document Id, which has 44 characters; by my count, web app URLs have 54-55 random characters. You certainly don't have to worry about brute force attack.

The weak spot is you or your program leaking the URL in some way. This is somewhat troublesome because if you suspect a leak, you can't change the URL easily the way we change passwords. To guard against that scenario, you may want to generate a token for your program to send with its GET or POST request to the app. The app would do something like

doGet(e) {
  if (e.parameter.token == "valid_token") {
    return information;
  • I like the token suggestion. It means that even if I don't trust the randomness or secrecy of the web app url, I can use my own secret key inside the app. And if I want to change the URL, I can make a copy the app and delete the old one.
    – user13097
    Commented Dec 22, 2017 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.