I have a Node.js/Express web app running on the Google Cloud Platform App Engine.
I'm restricting access to this application using the Identity Aware Proxy (IAP), so that only people in my company can access the website when they are logged on to Google using their corporate accounts.
This works great, only one thing annoys me:
For the OAuth 2 client that restricts the access, I have configured the URL of a privacy and data policy page which is linked from the Google login form that is shown to users when they try to access the website.
This privacy page is also served by my web application, so when people who are not yet logged in click on the link presented on the login form, they are asked to log in to view the privacy page, since all my web app's pages are protected by the IAP. A chicken-and-egg type of problem.
Is there a way to exclude specific URLs from the IAP and allow access without logging in?