Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan praktik terbaik untuk menggunakan Identity-Aware Proxy
(IAP).
Caching
Jangan gunakan CDN pihak ketiga di depan aplikasi Anda. CDN dapat meng-cache
konten dan menayangkan halaman yang di-cache kepada pengguna yang tidak diautentikasi.
Jika Anda memiliki resource besar yang tidak sensitif yang ingin ditayangkan dari
CDN, gunakan domain terpisah seperti images.yourapp.com untuk resource
ini. Gunakan CDN dengan domain tersebut dan tambahkan header respons HTTP Cache-control:
private ke semua objek yang hanya boleh ditayangkan
kepada pengguna yang diautentikasi.
Untuk perlindungan tambahan, periksa IP sumber permintaan di aplikasi Anda untuk memastikan permintaan tersebut berasal dari rentang IP yang sama dengan yang diizinkan oleh aturan firewall.
Di konsol Google Cloud , IAP akan menampilkan error atau peringatan jika aturan
firewall Anda tampaknya tidak disiapkan dengan benar. Konsol IAP Google Cloud tidak
mendeteksi VM mana yang digunakan untuk setiap layanan, sehingga analisis firewall tidak menyertakan fitur
lanjutan seperti jaringan non-default dan tag aturan firewall. Untuk mengabaikan analisis ini, aktifkan
IAP melalui
perintah
gcloud compute backend-services update.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eIdentity-Aware Proxy (IAP) best practices are outlined on this page, including caching, securing applications, and firewall configuration.\u003c/p\u003e\n"],["\u003cp\u003eAvoid using third-party CDNs directly in front of applications protected by IAP to prevent serving cached content to unauthenticated users.\u003c/p\u003e\n"],["\u003cp\u003eTo properly secure applications, use signed headers for App Engine standard environment, Compute Engine, and GKE.\u003c/p\u003e\n"],["\u003cp\u003eEnsure all requests to Compute Engine or GKE are routed through the load balancer and verify traffic is from a Google Front End (GFE) IP.\u003c/p\u003e\n"],["\u003cp\u003eIAP will display errors or warnings if firewall rules appear to be set incorrectly, however, not all advanced features are detectable.\u003c/p\u003e\n"]]],[],null,["# Best practices\n\nThis page describes best practices for using Identity-Aware Proxy\n(IAP).\n\nCaching\n-------\n\n- Don't use a third-party CDN in front of your application. CDNs may cache content and serve cached pages to unauthenticated users.\n - If you have large, non-sensitive resources that you want to serve from a CDN, use a separate domain such as `images.yourapp.com` for these resources. Use the CDN with that domain and add the `Cache-control:\n private` HTTP response header to all objects that should only be served to authenticated users.\n\nSecuring your app\n-----------------\n\nTo properly secure your app, you must use [signed headers](/iap/docs/signed-headers-howto)\nfor [App Engine standard environment](/appengine/docs/about-the-standard-environment),\nCompute Engine, and GKE applications.\n\nConfiguring your firewall\n-------------------------\n\n- Make sure all requests to Compute Engine or GKE are routed through the load balancer:\n - [Configure a firewall rule to allow health checking](/load-balancing/docs/health-checks) and make sure that all traffic to your Virtual Machine (VM) is from a Google Front End (GFE) IP.\n - For additional protection, check the source IP of requests in your app to make sure they're from the same IP range that the firewall rule allows.\n- In the Google Cloud console, IAP displays an error or warning if your firewall rules appear to be set up incorrectly. The IAP Google Cloud console doesn't detect which VM is used for each service, so the firewall analysis doesn't include advanced features like non-default networks and firewall rule tags. To bypass this analysis, enable IAP through the `gcloud compute backend-services update` command."]]
