Issue HTTPS requests

Go Java PHP Python

Region ID

The REGION_ID is an abbreviated code that Google assigns based on the region you select when you create your app. The code does not correspond to a country or province, even though some region IDs may appear similar to commonly used country and province codes. For apps created after February 2020, REGION_ID.r is included in App Engine URLs. For existing apps created before this date, the region ID is optional in the URL.

Learn more about region IDs.

OK

This page describes how to issue HTTP(S) requests from your App Engine app using the URL Fetch service for second-generation runtimes.

Before following the instructions on this page, we recommend you use language idiomatic solutions to issue HTTP(S) requests before using the URL Fetch service. The primary use case for using the URL Fetch is when you want to issue HTTP(S) requests to another App Engine app and assert your app's identity on that request.

For details on request size limits and which headers are sent in a URL Fetch request, see Outbound requests.

Issue an HTTP request

To use the URL Fetch service to issue outbound HTTP(S) requests, call the urlfetch package.

To issue an outbound HTTP request, use the http package as usual, but create your client using urlfetch.Client. urlfetch.Client returns an *http.Client that uses urlfetch.Transport, which is an implementation of the http.RoundTripper interface that makes requests using the URL Fetch API.

The following snippet demonstrates how to perform a basic HTTP GET request:

import (
    "fmt"
    "net/http"

    "google.golang.org/appengine/v2"
    "google.golang.org/appengine/v2/urlfetch"
)

func handler(w http.ResponseWriter, r *http.Request) {
    ctx := appengine.NewContext(r)
    client := urlfetch.Client(ctx)
    resp, err := client.Get("http://www.google.com/")
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    defer resp.Body.Close()
    fmt.Fprintf(w, "HTTP GET returned status %v", resp.Status)
}

Disable redirects

Important: To improve the security of your app, it is recommended that you disable redirects.

If you are using URL Fetch, the underlying URL Fetch service follows up to five redirects by default. These redirects could forward sensitive information, such as authorization headers, to the redirected destination. If your app does not require HTTP redirects, it is recommended that you disable the redirects.

To instruct the URL Fetch service to not follow redirects, set the CheckRedirect field of the http.Client returned from the urlfetch package to return http.ErrUseLastResponse. This applies to appengine/urlfetch and appengine/v2/urlfetch. For example:

client := urlfetch.Client(ctx)
client.CheckRedirect = func(*http.Request, []*http.Request) error {
  return http.ErrUseLastResponse
}

Issue an HTTPS request

By default, the underlying URL Fetch service validates the certificate of the host it contacts, and rejects requests if the certificate doesn't match. You don't need to explicitly secure your request.

Disable host certificate validation

To disable automatic host certificate validation, you can manually create a Transport and set AllowInvalidServerCertificate to true.

Issue a request to another App Engine app

When using URL Fetch to issue a request to another App Engine app, your app can assert its identity by adding the header X-Appengine-Inbound-Appid to the request.

If you instruct the URL Fetch service to not follow redirects, App Engine will add this header to requests automatically. See Disabling redirects for guidance on disabling redirects.

Note: If you are making requests to another App Engine application, use its REGION_ID.r.appspot.com domain name rather than a custom domain for your app.

What's next

Learn about the URL Fetch service, such as the headers that are sent in a URL Fetch request in Outbound Requests.