适用于Android应用和服务器的Google+ API登录

Question

My app has an Android client communicating with my own back-end server. I want to use the Google API to handle the user authorisation for me (using a Google+ account), so that the user does not need to sign up for a separate account for my app.

By following the documentation in https://developers.google.com/+/web/signin/server-side-flow , my understanding of the authentication flow is shown below. I am not sure it is correct, because it sounds like hijacking the Google API for my purpose.

1. User login on Android
2. Android client gets a one-time access code and send it to my server.
3. My server exchange refresh token and access token. (If the exchange is successful, the user is authenticated.)
4. If the user authenticated, I generate an access token on my server and give it to the Android client. The Android client can subsequently use the token to call my server's API.

Especially, I am doubtful about the point 3. I exchange the access code for the Google refresh token and access token, but I never use them. The purpose of the exchange is just to check whether the user has been authorised by Google. Does it sound quite correct? If not, what is the good way to do it?

Answer 1

After you receive access_token on your server, execute the cURL/network request to the Google server.

For example (in PHP):

<?php

    $access_token = $_GET['access_token']; // Get the access token

    $google_api_url = "https://www.googleapis.com/plus/v1/people/me?access_token=". $access_token; // Create Google API URL with access_token

    $c = curl_init($google_api_url); // Create network request to the Google server

    curl_setopt($c, CURLOPT_RETURNTRANSFER, true);

    $result = curl_exec($c); // Execute request and get the response from th Google server

    var_dump($result); // Print the result

RESULT OUTPUT (in JSON):

If access_token is valid

{
    "kind": "plus#person",
    "gender": "male",
    "emails": [
        {
            "value": "arr.mohd@gmail.com",
            "type": "account"
        }
    ],
    "objectType": "person",
    "id": "101571740244190011262",
    "displayName": "Rafique Mohammed",
    "name": {
     "familyName": "Mohammed",
     "givenName": "Rafique"
    },
    "url": "https://plus.google.com/101571740244190011262",
    "image": {
     "url": "https://lh6.googleusercontent.com/-pxiRX5gNkWE/AAAAAAAAAAI/AAAAAAAAAEg/99WWMsH16P8/photo.jpg?sz=50",
     "isDefault": false
    },.... //etc

If access_token is invalid

{
    "error": {
        "errors": [
            {
                "domain": "global",
                "reason": "authError",
                "message": "Invalid Credentials",
                "locationType": "header",
                "location": "Authorization"
            }
        ],
        "code": 401,
        "message": "Invalid Credentials"
    }
 }