StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>As others have mentioned, you can send a GET to <a href="https://www.googleapis.com/oauth2/v3/userinfo" rel="noreferrer">https://www.googleapis.com/oauth2/v3/userinfo</a>, using the OAuth2 bearer token you just received, and you will get a response with some information about the user (id, name, etc.).</p> <p>It's also worth mentioning that Google implements <a href="https://developers.google.com/accounts/cookbook/technologies/OpenID-Connect" rel="noreferrer">OpenID Connect</a> and that this user info endpoint is just one part of it.</p> <p><a href="http://openid.net/connect/" rel="noreferrer">OpenID Connect</a> is an authentication layer on top of OAuth2. When exchanging a authorization <code>code</code> at Google's token endpoint, you get an access token (the <code>access_token</code> parameter) as well as an OpenID Connect ID token (the <code>id_token</code> parameter).</p> <p>Both these tokens are <strong>JWT</strong> (JSON Web Token, <a href="http://tools.ietf.org/html/draft-ietf-oauth-json-web-token" rel="noreferrer">http://tools.ietf.org/html/draft-ietf-oauth-json-web-token</a>).</p> <p>If you decode them, you'll get some assertions, including the <strong>id</strong> of the user. If you link this ID to a user in your DB, you can immediately identify them without having to do an extra userinfo GET (saves time).</p> <p>As mentioned in the comments, these tokens are signed with Google's private key and you may want to verify the signature using Google's public key (<a href="https://www.googleapis.com/oauth2/v3/certs" rel="noreferrer">https://www.googleapis.com/oauth2/v3/certs</a>) to make sure they are authentic.</p> <p>You can see what's in a JWT by pasting it at <a href="https://jwt.io/" rel="noreferrer">https://jwt.io/</a> (scroll down for the JWT debugger). The assertions look something like:</p> <pre><code>{ "iss":"accounts.google.com", "id":"1625346125341653", "cid":"8932346534566-hoaf42fgdfgie1lm5nnl5675g7f167ovk8.apps.googleusercontent.com", "aud":"8932346534566-hoaf42fgdfgie1lm5nnl5675g7f167ovk8.apps.googleusercontent.com", "token_hash":"WQfLjdG1mDJHgJutmkjhKDCdA", "iat":1567923785, "exp":1350926995 } </code></pre> <p>There are also libraries for various programming languages to programatically decode JWTs.</p> <p><strong>PS</strong>: to get an up to date list of URLs and features supported by Google's OpenID Connect provider you can check that URL: <a href="https://accounts.google.com/.well-known/openid-configuration" rel="noreferrer">https://accounts.google.com/.well-known/openid-configuration</a>.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload