Get Jwt Payload from Google Sign-In without default Google popup

Question

I'm trying to use Google Sign-In from my web application (asp.net vb.net). Following the tutorial that Google provides, and using Google API libraries for .NET this is an easy task. https://developers.google.com/identity/sign-in/web/sign-in

Now the result of this approach is that I check on the client for a googleUser.getAuthResponse().id_token which is a JWT and send this to my server side code with ajax for validation and to get the payload with the Google unique user Id and other infos.

All this happens on the same page, with a popup from Google, triggered by the default button they provide in the tutorial.

What I'm trying to accomplish is to obtain the same JWT (id_token) without the popup, but actually issuing a redirect to Google, when the user clicks on a custom "Log in with Google" button.

Sadly all the example I found, even from Google itself, involve a much more complex interaction where you get a code from the server, that you then have to exchange for temporary and refresh tokens, and so on. While the client side approach with the popup window they provide, gives you immediatly the JWT token in response, not that code to request the token, that you have to validate then (I do this with Google.Net APIs with GoogleJsonWebSignature.ValidateAsync(externalToken) and retrieve the payload that way).

Looking at the urls in the popup, what I noticed that differs from all the examples I found that serve you the "code" for token exchange, are those parameters: flowName=GeneralOAuthFlow and response_type=permission%20id_token While the examples you find for server to server transaction all include calling Google with response_type=code

I tried tampering a bit with the popup url to let it open in a new full window, copying and modifying the url but with not much success. I'm redirected but without the id_token parameter.

Any hint would be much appreciated since I'm not able to find any documentation on response_type=permission%20id_token to query Google service.

Thanks in advance

Answer 1

For anyone interested... I found a solution. The url to redirect to is:

https://accounts.google.com/o/oauth2/auth?response_type=id_token&redirect_uri= {0}&scope= https://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profile&client_id= {1}&state={2}

Where {0} is the redirect url on your server, registered inside google console for this client_id {1} is your Google client_id {2} is some querystring or variable you want back to your server when the redirect happens

It works... it gives you back directly the id_token that you can verify with Google .NET APi with GoogleJsonWebSignature.ValidateAsync(id_token) and get as a result a payload (you have the payload class in Google Api .NET as well).

Only issue is that when Google comes back to your redirect url with the id_token in the querystring, it uses hash (url fragment #) so nothing is passed to the server.

There are workarounds with js to get the value and send to the server with ajax or redirect to the same page replacing the hash with? but this is very annoying. I imagine there are serious security reason for google to do this but from a dev standpoint is really a pain. Instead of all those hacks i resorted to the longer way requesting response_type=code instead of the id_token, which returns a canonical querystring with?code=...

If anyone knows how to get beck the id_token without the hash in the url it would be great.