Comment by tadhunt

We agree that this is an important use case, and is something we considered during the design. It is now supported by placing a Web Application Firewall in front of the App Engine application. We chose to limit the initial set of firewall features to IP address range blocking only — in part because that's sufficient to enable a WAF to front an App Engine Application.

-Tad Hunt (Manager on the App Engine team that brought you this firewall)