Google 登录流程后如何授权调用

Question

First things first, I've been trying to find an answer to this topic but most of the questions/answers refer to an already discontinued library Google Sign-In .

Also, most examples cover the Authentication (sign in, sign up) process, without addressing the User Session and authorization flow. By this, I mean: After the user signs in with Google, what am I supposed to do and how do I make sure subsequent calls to my server endpoints are authorized? For example, if the user has not (yet) authenticated with Google, then some endpoints in my server will reject the call with a 401.

I have been experimenting with the new library https://developers.google.com/identity with a Java Spring Boot server component, but the Google service only returns a jwt token with 1hr expiration after signup. That's not enough for a complete OAuth 2.0 implementation, right? (where's the refresh token?) How would I handle User sessions in my server if that token expires, and how to handle calls to my protected endpoints?

Then maybe using Google OAuth2.0 is what I'm looking for. But I thought this library https://developers.google.com/identity/protocols/oauth2) was only meant to access Google APIs and not for using those tokens to protect my own endpoints. I think this is where my assumption was wrong.

Can someone help me clarify this? and what's the best approach?

Answer 1

I can help with the general pattern, and it feels like your comment about using Google OAuth2 is correct.

IDENTITY PROVIDERS

There are lots of these - ways to sign in. Google is a good option but you may want others as well.

AUTHORIZATION SERVER (AS)

This manages connections to multiple identity providers, and then gives you full control over the tokens issued afterwards, so that you have what you need to protect your data.

It is common to choose an AS based on these types of capabilty:

• Authentication Capabilities
• Data Protection Capabilities

CHOOSING AN AUTHORIZATION SERVER

It feels like you are running into the foreign access token problem, which is common when plugging social login libraries into apps:

• Tokens from the likes of Facebook are definitely not meant to be used to protect your own APIs. One indicator of this is if no JWKS or Iintrospection endpoint is provided, meaning APIs have no way of validating access tokens.

I suspect that your problem might be that your app is using Google Sign In (Identity Provider), whereas Google OAuth2 (Authorization Server) would give you better options. I have not used this provider in a big way myself though, so cannot advise you on Google specifics.