服务器端Java Web应用程序中的Google OAuth2流

Question

I am facing an issue understanding the oauth2 flow. A user(identified by a user_id) initiates the GoogleAccounts connection in the browser.The request is passed to Servlet that sends Redirect String To Client (Javascript), which in turn redirects user to that Auth URL. On User Consent, the response is returned to callback url (mapped to a servlet). My Confusion here is when callback servlet is called,how do i identify to which user(user_id) does this authCode belong to? Do i have to use state param of oAuth2 ?

Please help.

Answer 1

As the comments suggest, the state param is your friend. The simplest way would be to simply set state=user_id . An alternate approach would be to start a server session and store the user ID in the session object. This latter approach assumes you have a relatively simple server, or your cluster supports shared sessions.