Java Web GoogleSignin - GoogleIdTokenVerifier 验证令牌字符串返回 null

Question

I am adding google register/signin to my web app and i have encountered a problem.

This is my code:

private static final HttpTransport transport = new NetHttpTransport();
private static final JsonFactory jsonFactory = new JacksonFactory();
private static final String MY_APP_GOOGLE_CLIENT_ID = "wouldntyouliketoknow";

public UsernamePasswordAuthenticationToken verify(final String idTokenString){

    GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, jsonFactory)
                                            .setAudience(Collections.singletonList(MY_APP_GOOGLE_CLIENT_ID))
                                            .build();

    try {
        GoogleIdToken idToken = verifier.verify(idTokenString);// <-- verifier.verify returns null !!!
        if (idToken != null) {
            Payload payload = idToken.getPayload();
            String email = payload.getEmail();
            if(Boolean.valueOf(payload.getEmailVerified())){
                UserJPA jpa = userRepository.findByEmail(email);
                if(jpa==null){
                    throw new UsernameNotFoundException("Cannot find user with email = "+email);
                }
                if(!jpa.isRegisterredWithGoogle()){
                    throw new UsernameNotFoundException("This user did not use the 'Register with google' option.");
                }
                bokiAuthenticationProvider.checkUserActiveAndUnlocked(jpa);

                return new UsernamePasswordAuthenticationToken(jpa.getUsername(), jpa.getPasswordHesh(), 
                        bokiAuthenticationProvider.getAuthorities(jpa.getUserHasRoleSecurityList()));
            }
        }else{
            System.out.println("The *idToken* object is null !!!");
        }
    } catch (GeneralSecurityException | IOException e) {
        e.printStackTrace();
    }

    throw new MyCustomException("Google token is invalid or has expired");
}

To create my CLIENT_ID I followed instructions here:

https://developers.google.com/identity/sign-in/web/devconsole-project

The problem is that verifier.verify keeps returning null .

I have checked:

• my user did register with google and the database fields are properly filled

• i am getting different string tokens from google each time i try google_sign_in

• my CLIENT_ID is valid and active in the google console.

To add to the confusion, this whole thing worked fine just a month ago. I went away on sick leave and when i came back, my boss welcomed me with this issue.

Anyone have any idea what might have happened?

Answer 1

I finally figured it out.

Since no one knew how to help me, i dropped the designated google libraries and went and made my own token verification from scratch.

I went and used the google-token-verifier-url-tool here :

https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123

At the bottom of the page here

https://developers.google.com/identity/protocols/OpenIDConnect

, i found how to decipher the json.

What i do is, I contact their online tool in code, get the json response and verify it manually. This is my code :

    private Map<String,String> getMapFromGoogleTokenString(final String idTokenString){
        BufferedReader in = null;
        try {
            // get information from token by contacting the google_token_verify_tool url :
            in = new BufferedReader(new InputStreamReader(
                                        ((HttpURLConnection) (new URL("https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=" + idTokenString.trim()))
                                        .openConnection()).getInputStream(), Charset.forName("UTF-8")));

            // read information into a string buffer :
            StringBuffer b = new StringBuffer();
            String inputLine;
            while ((inputLine = in.readLine()) != null){
                b.append(inputLine + "\n");
            }

            // transforming json string into Map<String,String> :
            ObjectMapper objectMapper = new ObjectMapper();
            return objectMapper.readValue(b.toString(), objectMapper.getTypeFactory().constructMapType(Map.class, String.class, String.class));

        // exception handling :
        } catch (MalformedURLException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        } catch(Exception e){
            System.out.println("\n\n\tFailed to transform json to string\n");
            e.printStackTrace();
        } finally{
            if(in!=null){
                try {
                    in.close();
                } catch (IOException e) {
                    e.printStackTrace();
                }
            }
        }
        return null;
    }

    // chack the "email_verified" and "email" values in token payload 
    private boolean verifyEmail(final Map<String,String> tokenPayload){
        if(tokenPayload.get("email_verified")!=null && tokenPayload.get("email")!=null){
            try{
                return Boolean.valueOf(tokenPayload.get("email_verified")) && tokenPayload.get("email").contains("@gmail.");
            }catch(Exception e){
                System.out.println("\n\n\tCheck emailVerified failed - cannot parse "+tokenPayload.get("email_verified")+" to boolean\n");
            }
        }else{
            System.out.println("\n\n\tCheck emailVerified failed - required information missing in the token");
        }
        return false;
    }

    // check token expiration is after now :
    private boolean checkExpirationTime(final Map<String,String> tokenPayload){
        try{
            if(tokenPayload.get("exp")!=null){
                // the "exp" value is in seconds and Date().getTime is in mili seconds
                return Long.parseLong(tokenPayload.get("exp")+"000") > new java.util.Date().getTime();
            }else{
                System.out.println("\n\n\tCheck expiration failed - required information missing in the token\n");
            }
        }catch(Exception e){
            System.out.println("\n\n\tCheck expiration failed - cannot parse "+tokenPayload.get("exp")+" into long\n");
        }
        return false;
    }

    // check that at least one CLIENT_ID matches with token values
    private boolean checkAudience(final Map<String,String> tokenPayload){
        if(tokenPayload.get("aud")!=null && tokenPayload.get("azp")!=null){
            List<String> pom = Arrays.asList("MY_CLIENT_ID_1",
                                             "MY_CLIENT_ID_2",
                                             "MY_CLIENT_ID_3");

            if(pom.contains(tokenPayload.get("aud")) || pom.contains(tokenPayload.get("azp"))){
                return true;
            }else{
                System.out.println("\n\n\tCheck audience failed - audiences differ\n");
                return false;
            }
        }
        System.out.println("\n\n\tCheck audience failed - required information missing in the token\n");
        return false;
    }

    // verify google token payload :
    private boolean doTokenVerification(final Map<String,String> tokenPayload){
        if(tokenPayload!=null){
            return verifyEmail(tokenPayload) // check that email address is verifies 
                && checkExpirationTime(tokenPayload) // check that token is not expired
                && checkAudience(tokenPayload) // check audience
                ; 
        }
        return false;
    }

Once i have had this detailed verification, i was able to see exactly where the mistake was ; The front end was sending me invalid CLIENT_ID value. [ grumble, grumble ] I have asked them about it about a hundred times and they told me that those values match. BAH !

So the mistake was not somewhere in my original code for token verification, it was an error in communication in my office.

I will revert back to the original code, with the proper CLIENT_ID this time for the sake of security. Still, i must make one complaint about the google library - it never told me why token verification was failing. It took me DAYS of pain staking effort to finally figure it out. I know they did it out of security, but still, the lack of support is galling.

Answer 2

Had similar issue. It was so stupid, but I just have wrong time on my server. I think verification always fail because expiration time of token is end in my server time universe.

Answer 3

For those who still having this issue:

1. Try python example( https://developers.google.com/identity/sign-in/web/backend-auth#python ) to ensure that you are using right CLIENT_ID, if no, you will see exception message with right CLIENT_ID

2. Use com.google.api-client of version 1.31.3 and com.google.oauth-client of version 1.31.4

3. Use com.google.api.client.json.gson.GsonFactory as JsonFactory

Answer 4

我通过从客户端发送idToken而不是authToken解决了我的问题

Answer 5

Not sure if anyone is still looking at this, but the code from google GitHub actually solved this for me. https://github.com/googlearchive/gplus-verifytoken-java/tree/master/src/com/google/plus/samples/verifytoken

They mention that the project is no longer actively maintained, and remains there as an archive of this work though.

Answer 6

I found two reasons of why it can happen.

1. There is a CLIENT_ID mismatch between the Spring boot server and the frontend library.
2. The token id which is generated upon Sign in with Google is expired. It generally expires after 1 hour.

Solution to refresh the auth token:

We get a reloadAuthResponse method on the response object upon successful sign in. Also, we get the expires_in property which gives us the number of milliseconds after which the token will expire. Following is the code snippet to use it.

const handleSuccessfulGoogleResponse = (response) => {
 console.log(response)
 const loginDetails = {
   name: response.profileObj.name,
   email: response.profileObj.email,
   tokenId: response.tokenId
 }
 //Do what is needed with the data
 refreshTokenGenerator(response);
}

const refreshTokenGenerator = res => {
 let refreshTime = (res.tokenObj.expires_in || 3600 - 50 * 60) * 1000;
 const refreshToken = async () => {
    console.log('running at ',new Date(Date.now()).toLocaleTimeString());
    const refreshedResponse = await res.reloadAuthResponse();
    refreshTime = (refreshedResponse.expires_in || 3600 - 50 * 60) * 
   1000;

   const newTokenId = refreshedResponse.id_token;
   //store the newTokenId and use it for the network calls
    setTimeout(refreshToken, refreshTime);
 }
 setTimeout(refreshToken, refreshTime);
}

Here, the handleSuccessfulGoogleResponse() is executed upon a successful sign in. We are calling the refreshTokenGenerator() inside it which uses the expires_in property(if it exists otherwise 3600ms by default). We are then using setTimeout() to execute the function to generate the new token before the current one expires.