如何在删除用户帐户时重置omniauth-google-oauth2 access_token

Question

We have this ROR application that uses omniauth-google-oauth2 with devise to sign in users. We are encountering an issue where if the user's account has been deleted from system after the user already granted access to the application from his google account, the authentication just goes in an endless loop of authentication.

The scenario goes something like:

1. The user authenticates via google and grants access for the application
2. In the callback, our application determines if the user account is valid - deleted, or not created (our system does not support self service registration
3. The user is not authorised (and not signed in) which is correct)
4. If the user attempts to sign-in via Google again, to try another account, Google transparently authorizes and redirects the user back to our application without giving the user a chance to change accounts.

The user can actually get out of this loop by logging out of first. But that's not really obvious to the average user so is not an ideal solution.

Ideally, the solution would be to invalidate the access_token or revoke the application authorization in the callback phase so that when the user tries to sign in again they can switch accounts.

Answer 1

It is possible to override the approval_prompt in the sign_in url, so you can set it to "force" and thereby getting the user out of the catch-22, even though the google_oauth2 devise configuration has it set to "auto" (default).

The trick is to communicate that this is what is needed from within the OmniauthCallbacksController. One simple and unobtrusive way is to simply set a temporary cookie:

class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def google_oauth2
    if user = User.find_for_google_oauth2(request.env["omniauth.auth"])
      cookies.delete :google_oauth2_approval_prompt
      flash[:notice] = I18n.t( "devise.omniauth_callbacks.success", kind: "Google")
      sign_in_and_redirect user, event: :authentication
    else 
      # we are not supporting self-service registration, so although
      # user has authenticated at Google and given consent to the app,
      # we are not going to allow the user in
      cookies[:google_oauth2_approval_prompt] = "force"
      flash[:error] = I18n.t( "devise.omniauth_callbacks.failure", kind: "Google", reason: "account not provisioned")
      redirect_to root_url
    end
  end
end

Then in the view that renders the Google login, conditionally append the approval_prompt:

:ruby
  extra_params = if approval_prompt = cookies[:google_oauth2_approval_prompt]
    {approval_prompt: approval_prompt}
  else
    {}
  end

= link_to "Sign-in with Google", 
  user_omniauth_authorize_path(:google_oauth2,extra_params)

So with all that in place, if a user first tries with a Google account that the application decides it is not going to accept, the user will have the chance to switch accounts when they try to login again (because they'll be sent via the force-approval workflow).