Google登录，如何存储会话状态？

Question

I'm not sure I am asking this question correctly. I want to use Google Sign-In to authenticate users for either certain actions on my web application or to certain pages of the application.

I have followed the instructions for Google Sign-In and I am getting the id_token and passing that to my server which then uses the tokeninfo endpoint to verify the id_token and exchange the id_token for user information.

Do I have to get an id_token and pass that to my server and then to the tokeninfo endpoint for verification every time I want to do some PHP action or is there a way to store the authenticated state to prevent all of these calls to the tokeninfo endpoint once the user is authenticated?

I'm just not sure how to go about that last part. Right now I am passing the token to my server with javascript like this.

    function sendToken(googleUser) {
        var id_token = googleUser.getAuthResponse().id_token;
        console.log(id_token);
        var xhr = new XMLHttpRequest();
        xhr.open('POST', 'https://app.mydomain.com/test.php');
        xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
        xhr.onload = function() {
            console.log(xhr.responseText);
        };
        xhr.send('idtoken=' + id_token);
    }

Then on my backend I am doing this in PHP.

$url = 'https://www.googleapis.com/oauth2/v3/tokeninfo';
$myvars = 'id_token=' . $_POST["idtoken"];

$ch = curl_init( $url  );
curl_setopt( $ch, CURLOPT_POST, 1 );
curl_setopt( $ch, CURLOPT_POSTFIELDS, $myvars );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1 );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );

$response = curl_exec( $ch  );

I then check $response to validate the user and continue actions like inserting in the database if the user was validated by Google. I am doing this validation each time a user needs to input data into the database which seems slow to me. So I am sure I am missing some step that would make things better.

Thanks!

Answer 1

I know it's not PHP but this answer might be useful to you too.

Basically, it's not a matter of Google Sign-in but a matter of PHP (and whichever PHP framework you're using). In your $response I believe you'll get the user's email address. You now need to set a session cookie that that's the email. Once you've done that you're done with Google Sign-In. Now it's just your user, your PHP code and the user's cookies that matter.