OAuth2回调-识别用户？

Question

I'm working on web app where I need to ask user to grant access to their google calendar (so I can read and create events on their behalf).

To summarize my question, consider the oauth flow:

client (session) -> backend (session) -> google (grant access) -> backend (how do I know the user in this step to store the refresh_token?)

Possible dummy solution:

client (session) -> backend (session) -> google (grant access) -> client (session) -> backend (session)

More details

Here is the default flow:

• user logs in to my web app ( client )
• the web app then asks the user to start oauth2 flow ( client )
• so user presses "start auth flow" button which sends "start auth flow" request to my backend ( client )
• on the backend there is an oauth client that generates the request url and redirects user to that url ( backend ):

 const authUrl = new google.auth.OAuth2(clientId, secret, redirectUrl)).generateAuthUrl(options) res.redirect(authUrl) 

• this redirects user to the google consent page. ( google )
• Once user granted the permission, they are redirected back to the url specified in OAuth2 client ( backend , my "callback" endpoint)
• at this point I need to save the refresh_token to the user's database location. ( backend )

And here is the question: how do I understand in the "callback" that this is still the same user who started the flow?

That might sound dumb, but I'm stuck with that.

I understand that session should solve that, but since the "callback" is triggered by google's server and it's my backend endpoint (and not a browser page), there is no session unless I'm missing something.

In my understanding this is how it can be implemented which involves redirect to browser first:

• user logs in to my web app and I set the session cookie ( client )
• user starts the oauth2 flow ( client/backend )
• the callback then redirects back to some dummy client-side page ( google )
• this dummy page extracts the auth code passed from google and sends it to my backend endpoint, passing the session along the way ( client )
• now server knows who has performed the "callback" ( backend )

But that doesn't look like a good approach with all that back and forth between client and backend

So is there a way to identify user during the callback without involving browser in the middle of the process? How to do that?

I'm working with nodejs and express in case that matters

Thanks

Answer 1

You should keep the refresh token on the server in a database. This is the most secure way and prevents attacker from accessing the refresh token over the wire and using it to access their account.

Create an id for the user, use that id to map to client data on server such as refresh token. Pass that id back to the browser and client in cookies or JWT. Then, whenever user makes a request back to your server they will always pass that id you created in cookies. You can use that id to lookup the user in the database and get the refresh token.

Answer 2

Try using passportJs which provides authentication using third party authentication providers.

var GoogleStrategy = require( 'passport-google-oauth2' ).Strategy;

passport.use(new GoogleStrategy({
    clientID:     GOOGLE_CLIENT_ID,
    clientSecret: GOOGLE_CLIENT_SECRET,
    callbackURL: "http://yourdormain:3000/auth/google/callback",
    passReqToCallback   : true   },   function(request, accessToken, refreshToken, profile, done) {
    User.findOrCreate({ googleId: profile.id }, function (err, user) {
      return done(err, user);
    });   } ));

Answer 3

It appeared that there is a parameter called state that one can use to pass specific data and google will return it back. This solves my question since I can pass user id or my session token as state and read it in the callback.

From the doc :

state Recommended.

Specifies any string value that your application uses to maintain state between your authorization request and the authorization server's response. The server returns the exact value that you send as a name=value pair in the hash (#) fragment of the redirect_uri after the user consents to or denies your application's access request.

In case of nodejs google oauth2 library that may look like this:

oauth2ClientGlobal.generateAuthUrl({
            access_type: 'offline',
            scope: this.scopes(),
            state: base64UserId // <- google will return this param back
        });