Workaround seems to be to disable automatic cookie handling by calling:

service.setCookieManager(null);

just don't know about the side effects...

See also Issue over at GAE: http://code.google.com/p/googleappengine/issues/detail?id=1272

Actually the right way to disable automatic cookie handling (which would currently be needed due to the restrictions of the App Engine Java Environment) is to set the according system property:

System.setProperty(GoogleGDataRequest.DISABLE_COOKIE_HANDLER_PROPERTY, "true");

Unfortunately this results in getting an error because of missing authentication header information:

java.lang.NullPointerException: No authentication header information
	at com.google.gdata.util.AuthenticationException.initFromAuthHeader(AuthenticationException.java:95)
	at com.google.gdata.util.AuthenticationException.(AuthenticationException.java:66)
	at com.google.gdata.client.http.HttpGDataRequest.handleErrorResponse(HttpGDataRequest.java:509)
	at com.google.gdata.client.http.GoogleGDataRequest.handleErrorResponse(GoogleGDataRequest.java:562)
	at com.google.gdata.client.http.HttpGDataRequest.checkResponse(HttpGDataRequest.java:481)
	at com.google.gdata.client.http.HttpGDataRequest.execute(HttpGDataRequest.java:460)
	at com.google.gdata.client.http.GoogleGDataRequest.execute(GoogleGDataRequest.java:534)
	at com.google.gdata.client.Service.getFeed(Service.java:962)
	at com.google.gdata.client.Service.getFeed(Service.java:819)
	at com.google.gdata.client.GoogleService.getFeed(GoogleService.java:593)
	at com.google.gdata.client.Service.getFeed(Service.java:838)
	at com.feth.appengine.contactsync.server.gcontacts.AuthenticationServlet.doGet(AuthenticationServlet.java:92)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:693)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:806)
	at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487)
	at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1093)
	at com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:43)
	at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
	at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:360)
	at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
	at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
	at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:712)
	at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:405)
	at com.google.apphosting.utils.jetty.DevAppEngineWebAppContext.handle(DevAppEngineWebAppContext.java:54)
	at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
	at com.google.appengine.tools.development.JettyContainerService$ApiProxyHandler.handle(JettyContainerService.java:306)
	at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
	at org.mortbay.jetty.Server.handle(Server.java:313)
	at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:506)
	at org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:830)
	at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:514)
	at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:211)
	at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:381)
	at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:396)
	at org.mortbay.thread.BoundedThreadPool$PoolThread.run(BoundedThreadPool.java:442)

interestingly java.net.CookieHandler seems to be on the white list for Google App Engine: http://code.google.com/appengine/docs/java/jrewhitelist.html.

Still, invoking this code:

java.net.CookieHandler.setDefault(new CookieHandler(){

	@Override
	public Map<String, List<String>> get(URI uri,
			Map<String, List<String>> requestHeaders)
			throws IOException {
		return null;
	}

	@Override
	public void put(URI uri, Map<String, List<String>> responseHeaders)
			throws IOException {
	}
});

results in an java.security.AccessControlException: access denied (java.net.NetPermission setCookieHandler) error.

Its kind of a readonly access.  You can use the default cookie handler, but cannot
inject your custom handler.  So you need the system property.

As far as the authentication issue., could you send me the http trace for the failing
auth request?

Weird I retried gdata client lib 1.30.0 with appengine 1.2.0 sdk.  I couldnt
reproduce the issue.  Please send me the wire trace, that may provide more clues into
why you are seeing that error.

While preparing the HTTP traces, I found the following:
it seems as if the problem occured because of a wrong authentication scope when generating the auth sub url using AuthSubUtil.getRequestUrl(...).

I used: http://www.google.com/m8/feeds/ (this failed) - when I am using: https://www.google.com/m8/feeds/contacts/default/full it works.

The official documentation (http://code.google.com/intl/de-DE/apis/contacts/docs/2.0/developers_guide_protocol.html#auth_sub) however says to use http://www.google.com/m8/feeds/.

By the way, I do not have any of these problems when using the Docs API instead of the Contacts API.

Regarding the traces: I prepared them, but it seems as if there is a lot of sensitive data in there - which parts do I need to remove before posting them 
here?!

Did you try the contacts API or a different one? I have an idea why it fails: if the 
the auth scope is using a different protocol (e.g. http instead of https) than the 
requested URL has, a NullPointer exception gets thrown.

I havent had chance to look at this issue.  It should work with http as well. weird.

Is this blocking you? or using https is an acceptable solution for you?

Having the same issues (google apps + gdata 1.30) - tried
service.setCookieManager(null) - no luck

The code works when running from a shell and retrieves portfolio data

Through commenting/uncommenting it seems that one can authenticate but using a feed
from the FinancialService produces a security exception.

FinanceService service = new FinanceService("MyService-1.0");
service.getAuthTokenFactory().getAuthToken();
service.setUserCredentials("[a valid email]", "[a valid password]"]);

//OK to Here

String feedUrl = "http://finance.google.com/finance/feeds/default/portfolios";
//Requesting Feed 
PortfolioFeed portfolioFeed = _service.getFeed(new URL(feedUrl), PortfolioFeed.class);

//Dies with the following stack

java.lang.ExceptionInInitializerError
	at
com.google.gdata.client.http.GoogleGDataRequest$Factory.getRequest(GoogleGDataRequest.java:77)
	at com.google.gdata.client.Service.createRequest(Service.java:600)
	at com.google.gdata.client.GoogleService.createRequest(GoogleService.java:487)
	at com.google.gdata.client.Service.createFeedRequest(Service.java:988)
	at com.google.gdata.client.Service.getFeed(Service.java:818)
	at com.google.gdata.client.GoogleService.getFeed(GoogleService.java:593)
	at com.google.gdata.client.Service.getFeed(Service.java:838)
	at com.activebaskets.portfolio.User.getPortfolioList(User.java:644)
	at org.apache.jsp.index_jsp._jspService(index_jsp.java:163)
	at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:94)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
	at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487)
	at
org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1093)
	at
com.google.apphosting.runtime.jetty.SaveSessionFilter.doFilter(SaveSessionFilter.java:35)
	at
org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
	at
com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter(TransactionCleanupFilter.java:43)
	at
org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
	at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:360)
	at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
	at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
	at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:712)
	at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:405)
	at
com.google.apphosting.runtime.jetty.AppVersionHandlerMap.handle(AppVersionHandlerMap.java:237)
	at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
	at org.mortbay.jetty.Server.handle(Server.java:313)
	at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:506)
	at
org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete(HttpConnection.java:830)
	at
com.google.apphosting.runtime.jetty.RpcRequestParser.parseAvailable(RpcRequestParser.java:63)
	at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:381)
	at
com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest(JettyServletEngineAdapter.java:125)
	at com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235)
	at
com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4547)
	at
com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest(RuntimePb.java:4545)
	at
com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest(BlockingApplicationHandler.java:24)
	at com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359)
	at com.google.net.rpc.impl.Server$2.run(Server.java:792)
	at com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56)
	at
com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan(LocalTraceSpanBuilder.java:489)
	at com.google.net.rpc.impl.Server.startRpc(Server.java:748)
	at com.google.net.rpc.impl.Server.processRequest(Server.java:340)
	at com.google.net.rpc.impl.ServerConnection.messageReceived(ServerConnection.java:422)
	at com.google.net.rpc.impl.RpcConnection.parseMessages(RpcConnection.java:319)
	at com.google.net.rpc.impl.RpcConnection.dataReceived(RpcConnection.java:290)
	at com.google.net.async.Connection.handleReadEvent(Connection.java:419)
	at com.google.net.async.EventDispatcher.processNetworkEvents(EventDispatcher.java:733)
	at com.google.net.async.EventDispatcher.internalLoop(EventDispatcher.java:207)
	at com.google.net.async.EventDispatcher.loop(EventDispatcher.java:101)
	at com.google.net.rpc.RpcService.runUntilServerShutdown(RpcService.java:249)
	at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run(JavaRuntime.java:373)
	at java.lang.Thread.run(Unknown Source)
Caused by: java.security.AccessControlException: access denied
(java.net.NetPermission getCookieHandler)
	at java.security.AccessControlContext.checkPermission(Unknown Source)
	at java.security.AccessController.checkPermission(Unknown Source)
	at java.lang.SecurityManager.checkPermission(Unknown Source)
	at java.net.CookieHandler.getDefault(Unknown Source)
	at
com.google.gdata.client.http.GoogleGDataRequest$GoogleCookieHandler.<init>(GoogleGDataRequest.java:334)
	at
com.google.gdata.client.http.GoogleGDataRequest$GoogleCookieHandler.<init>(GoogleGDataRequest.java:323)
	at com.google.gdata.client.http.GoogleGDataRequest.<clinit>(GoogleGDataRequest.java:426)
	... 50 more

I see there is a new load of gdata (1.31). Mine is 1.30. Does anyone know if the
update fixes tis issue? Nothing about it in the release notes
http://code.google.com/p/gdata-java-client/wiki/ReleaseNotes

Please check this FAQ:
http://code.google.com/intl/zh-HK/appengine/kb/java.html#googledata

Let us know if this fixes the problem.

I'm having the same problem with the spreadsheets API.  Adding 

<system-properties>
  <property name="com.google.gdata.DisableCookieHandler" value="true"/>
</system-properties>
to the web.xml didn't seem to help with using 1.30.0 and earlier.  I can't tell if
1.31.1 has this changed since 1.31.1 throws an exception on creating the service. Am
I doing something wrong?

Comment#12 by vbarathan WORKS. on gdata 1.31.1

(No comment was entered for this change.)

When I set
 <system-properties>
  <property name="com.google.gdata.DisableCookieHandler" value="true"/>
</system-properties>

, I can't use datastore.

What can i do?

Fixed it for me; thanks Google Team; Awesome work!

<system-properties>
  <property name="com.google.gdata.DisableCookieHandler" value="true"/>
</system-properties>


java.lang.ExceptionInInitializerError at 
com.google.gdata.client.http.GoogleGDataRequest$Factory.createRequest
(GoogleGDataRequest.java:73) at 
com.google.gdata.client.http.HttpGDataRequest$Factory.getRequest
(HttpGDataRequest.java:161) at 
com.google.gdata.client.http.HttpGDataRequest$Factory.getRequest
(HttpGDataRequest.java:167) at com.google.gdata.client.Service.createRequest
(Service.java:677) at com.google.gdata.client.GoogleService.createRequest
(GoogleService.java:535) at com.google.gdata.client.Service.createFeedRequest
(Service.java:1138) at com.google.gdata.client.Service.getFeed(Service.java:958) at 
com.google.gdata.client.GoogleService.getFeed(GoogleService.java:662) at 
com.google.gdata.client.Service.query(Service.java:1119) at 
com.google.gdata.client.Service.query(Service.java:1060) at 
com.lighthouseracing.application.server.BooksClient.searchVolumes
(BooksClient.java:81) at 
com.lighthouseracing.application.server.BooksClient.getSearchList
(BooksClient.java:390) at com.lighthouseracing.application.server.JR.doGet
(JR.java:59) at javax.servlet.http.HttpServlet.service(HttpServlet.java:693) at 
javax.servlet.http.HttpServlet.service(HttpServlet.java:806) at 
org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487) at 
org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter
(ServletHandler.java:1093) at 
com.google.apphosting.runtime.jetty.SaveSessionFilter.doFilter
(SaveSessionFilter.java:35) at 
org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter
(ServletHandler.java:1084) at 
com.google.apphosting.utils.servlet.TransactionCleanupFilter.doFilter
(TransactionCleanupFilter.java:43) at 
org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter
(ServletHandler.java:1084) at org.mortbay.jetty.servlet.ServletHandler.handle
(ServletHandler.java:360) at org.mortbay.jetty.security.SecurityHandler.handle
(SecurityHandler.java:216) at org.mortbay.jetty.servlet.SessionHandler.handle
(SessionHandler.java:181) at org.mortbay.jetty.handler.ContextHandler.handle
(ContextHandler.java:712) at org.mortbay.jetty.webapp.WebAppContext.handle
(WebAppContext.java:405) at 
com.google.apphosting.runtime.jetty.AppVersionHandlerMap.handle
(AppVersionHandlerMap.java:237) at org.mortbay.jetty.handler.HandlerWrapper.handle
(HandlerWrapper.java:139) at org.mortbay.jetty.Server.handle(Server.java:313) at 
org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:506) at 
org.mortbay.jetty.HttpConnection$RequestHandler.headerComplete
(HttpConnection.java:830) at 
com.google.apphosting.runtime.jetty.RpcRequestParser.parseAvailable
(RpcRequestParser.java:76) at org.mortbay.jetty.HttpConnection.handle
(HttpConnection.java:381) at 
com.google.apphosting.runtime.jetty.JettyServletEngineAdapter.serviceRequest
(JettyServletEngineAdapter.java:125) at 
com.google.apphosting.runtime.JavaRuntime.handleRequest(JavaRuntime.java:235) at 
com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest
(RuntimePb.java:4755) at 
com.google.apphosting.base.RuntimePb$EvaluationRuntime$6.handleBlockingRequest
(RuntimePb.java:4753) at 
com.google.net.rpc.impl.BlockingApplicationHandler.handleRequest
(BlockingApplicationHandler.java:24) at 
com.google.net.rpc.impl.RpcUtil.runRpcInApplication(RpcUtil.java:359) at 
com.google.net.rpc.impl.Server$2.run(Server.java:800) at 
com.google.tracing.LocalTraceSpanRunnable.run(LocalTraceSpanRunnable.java:56) at 
com.google.tracing.LocalTraceSpanBuilder.internalContinueSpan
(LocalTraceSpanBuilder.java:510) at com.google.net.rpc.impl.Server.startRpc
(Server.java:756) at com.google.net.rpc.impl.Server.processRequest(Server.java:348) 
at com.google.net.rpc.impl.ServerConnection.messageReceived
(ServerConnection.java:459) at com.google.net.rpc.impl.RpcConnection.parseMessages
(RpcConnection.java:319) at com.google.net.rpc.impl.RpcConnection.dataReceived
(RpcConnection.java:290) at com.google.net.async.Connection.handleReadEvent
(Connection.java:419) at com.google.net.async.EventDispatcher.processNetworkEvents
(EventDispatcher.java:762) at com.google.net.async.EventDispatcher.internalLoop
(EventDispatcher.java:207) at com.google.net.async.EventDispatcher.loop
(EventDispatcher.java:101) at com.google.net.rpc.RpcService.runUntilServerShutdown
(RpcService.java:251) at com.google.apphosting.runtime.JavaRuntime$RpcRunnable.run
(JavaRuntime.java:373) at java.lang.Thread.run(Unknown Source) Caused by: 
java.security.AccessControlException: access denied (java.net.NetPermission 
getCookieHandler) at java.security.AccessControlContext.checkPermission(Unknown 
Source) at java.security.AccessController.checkPermission(Unknown Source) at 
java.lang.SecurityManager.checkPermission(Unknown Source) at 
java.net.CookieHandler.getDefault(Unknown Source) at 
com.google.gdata.client.http.GoogleGDataRequest$GoogleCookieHandler.
(GoogleGDataRequest.java:316) at 
com.google.gdata.client.http.GoogleGDataRequest$GoogleCookieHandler.
(GoogleGDataRequest.java:305) at com.google.gdata.client.http.GoogleGDataRequest.
(GoogleGDataRequest.java:408) ... 54 more 

Problem still there. Any help would be nice :)

zed163,

Are you referring to issue with authentication or disabling cookie handler in appengine?

Sorry my fault. 
<system-properties>
  <property name="com.google.gdata.DisableCookieHandler" value="true"/>
</system-properties>
fixed the problem 

i have the same problem...

do you still have the problem after disabling the cookiehandler?

<system-properties>
  <property name="com.google.gdata.DisableCookieHandler" value="true"/>
</system-properties>

solution (for me) : put 

<system-properties>
  <property name="com.google.gdata.DisableCookieHandler" value="true"/>
</system-properties>

 in  eclipse_project/war/WEB-INF/appengine-web.xml 

This worked for me as well.  I don't know if there are any negative side-effects yet.