如果您透過 Google 登入使用與後端伺服器通訊的應用程式或網站,您可能需要在伺服器上識別目前登入的使用者。如要採用安全的方式處理,當使用者成功登入後,請使用 HTTPS 將使用者的 ID 權杖傳送至您的伺服器。接著,在伺服器中驗證 ID 權杖的完整性,並使用權杖中的使用者資訊建立工作階段或建立新帳戶。
將 ID 權杖傳送至您的伺服器
首先,請在使用者登入時,取得自己的 ID 權杖:
-
設定 Google 登入功能時,請呼叫
requestIdToken
方法,並傳遞您的伺服器' 網路用戶端 ID。// Request only the user's ID token, which can be used to identify the // user securely to your backend. This will contain the user's basic // profile (name, profile picture URL, etc) so you should not need to // make an additional call to personalize your application. GoogleSignInOptions gso = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN) .requestIdToken(getString(R.string.server_client_id)) .requestEmail() .build();
-
應用程式啟動時,請呼叫
silentSignIn
,檢查使用者是否已在這部裝置或其他裝置上透過 Google 登入應用程式:GoogleSignIn.silentSignIn() .addOnCompleteListener( this, new OnCompleteListener<GoogleSignInAccount>() { @Override public void onComplete(@NonNull Task<GoogleSignInAccount> task) { handleSignInResult(task); } });
-
如果使用者以無訊息方式登入,請呈現一般的登出體驗,讓使用者選擇登入。當使用者登入時,請在登入意圖的活動結果中取得使用者的
GoogleSignInAccount
:// This task is always completed immediately, there is no need to attach an // asynchronous listener. Task<GoogleSignInAccount> task = GoogleSignIn.getSignedInAccountFromIntent(data); handleSignInResult(task);
-
以無訊息或明確的方式登入之後,請透過
GoogleSignInAccount
物件取得 ID 權杖:private void handleSignInResult(@NonNull Task<GoogleSignInAccount> completedTask) { try { GoogleSignInAccount account = completedTask.getResult(ApiException.class); String idToken = account.getIdToken(); // TODO(developer): send ID Token to server and validate updateUI(account); } catch (ApiException e) { Log.w(TAG, "handleSignInResult:error", e); updateUI(null); } }
接著,透過 HTTPS POST 要求,將 ID 權杖傳送至您的伺服器:
HttpClient httpClient = new DefaultHttpClient(); HttpPost httpPost = new HttpPost("https://yourbackend.example.com/tokensignin"); try { List<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>(1); nameValuePairs.add(new BasicNameValuePair("idToken", idToken)); httpPost.setEntity(new UrlEncodedFormEntity(nameValuePairs)); HttpResponse response = httpClient.execute(httpPost); int statusCode = response.getStatusLine().getStatusCode(); final String responseBody = EntityUtils.toString(response.getEntity()); Log.i(TAG, "Signed in as: " + responseBody); } catch (ClientProtocolException e) { Log.e(TAG, "Error sending ID token to backend.", e); } catch (IOException e) { Log.e(TAG, "Error sending ID token to backend.", e); }
驗證 ID 權杖的完整性
透過 HTTPS POST 接收 ID 權杖後,您必須驗證權杖的完整性。
To verify that the token is valid, ensure that the following criteria are satisfied:
- The ID token is properly signed by Google. Use Google's public keys
(available in
JWK or
PEM format)
to verify the token's signature. These keys are regularly rotated; examine
the
Cache-Control
header in the response to determine when you should retrieve them again. - The value of
aud
in the ID token is equal to one of your app's client IDs. This check is necessary to prevent ID tokens issued to a malicious app being used to access data about the same user on your app's backend server. - The value of
iss
in the ID token is equal toaccounts.google.com
orhttps://accounts.google.com
. - The expiry time (
exp
) of the ID token has not passed. - If you want to restrict access to only members of your G Suite domain,
verify that the ID token has an
hd
claim that matches your G Suite domain name.
Rather than writing your own code to perform these verification steps, we strongly
recommend using a Google API client library for your platform, or a general-purpose
JWT library. For development and debugging, you can call our tokeninfo
validation endpoint.
Using a Google API Client Library
Using one of the Google API Client Libraries (e.g. Java, Node.js, PHP, Python) is the recommended way to validate Google ID tokens in a production environment.
To validate an ID token in Java, use the GoogleIdTokenVerifier object. For example:
import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken; import com.google.api.client.googleapis.auth.oauth2.GoogleIdToken.Payload; import com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier; ... GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, jsonFactory) // Specify the CLIENT_ID of the app that accesses the backend: .setAudience(Collections.singletonList(CLIENT_ID)) // Or, if multiple clients access the backend: //.setAudience(Arrays.asList(CLIENT_ID_1, CLIENT_ID_2, CLIENT_ID_3)) .build(); // (Receive idTokenString by HTTPS POST) GoogleIdToken idToken = verifier.verify(idTokenString); if (idToken != null) { Payload payload = idToken.getPayload(); // Print user identifier String userId = payload.getSubject(); System.out.println("User ID: " + userId); // Get profile information from payload String email = payload.getEmail(); boolean emailVerified = Boolean.valueOf(payload.getEmailVerified()); String name = (String) payload.get("name"); String pictureUrl = (String) payload.get("picture"); String locale = (String) payload.get("locale"); String familyName = (String) payload.get("family_name"); String givenName = (String) payload.get("given_name"); // Use or store profile information // ... } else { System.out.println("Invalid ID token."); }
The GoogleIdTokenVerifier.verify()
method verifies the JWT
signature, the aud
claim, the iss
claim, and the
exp
claim.
If you want to restrict access to only members of your G Suite domain,
also verify the hd
claim by checking the domain name
returned by the Payload.getHostedDomain()
method.
To validate an ID token in Node.js, use the Google Auth Library for Node.js. Install the library:
npm install google-auth-library --saveThen, call the
verifyIdToken()
function. For example:
const {OAuth2Client} = require('google-auth-library'); const client = new OAuth2Client(); async function verify() { const ticket = await client.verifyIdToken({ idToken: token, audience: CLIENT_ID, // Specify the CLIENT_ID of the app that accesses the backend // Or, if multiple clients access the backend: //[CLIENT_ID_1, CLIENT_ID_2, CLIENT_ID_3] }); const payload = ticket.getPayload(); const userid = payload['sub']; // If request specified a G Suite domain: // const domain = payload['hd']; } verify().catch(console.error);
The verifyIdToken
function verifies
the JWT signature, the aud
claim, the exp
claim,
and the iss
claim.
If you want to restrict access to only members of your G Suite domain,
also verify the hd
claim matches your G Suite domain name.
To validate an ID token in PHP, use the Google API Client Library for PHP. Install the library (for example, using Composer):
composer require google/apiclientThen, call the
verifyIdToken()
function. For example:
require_once 'vendor/autoload.php'; // Get $id_token via HTTPS POST. $client = new Google_Client(['client_id' => $CLIENT_ID]); // Specify the CLIENT_ID of the app that accesses the backend $payload = $client->verifyIdToken($id_token); if ($payload) { $userid = $payload['sub']; // If request specified a G Suite domain: //$domain = $payload['hd']; } else { // Invalid ID token }
The verifyIdToken
function verifies
the JWT signature, the aud
claim, the exp
claim,
and the iss
claim.
If you want to restrict access to only members of your G Suite domain,
also verify the hd
claim matches your G Suite domain name.
To validate an ID token in Python, use the verify_oauth2_token function. For example:
from google.oauth2 import id_token from google.auth.transport import requests # (Receive token by HTTPS POST) # ... try: # Specify the CLIENT_ID of the app that accesses the backend: idinfo = id_token.verify_oauth2_token(token, requests.Request(), CLIENT_ID) # Or, if multiple clients access the backend server: # idinfo = id_token.verify_oauth2_token(token, requests.Request()) # if idinfo['aud'] not in [CLIENT_ID_1, CLIENT_ID_2, CLIENT_ID_3]: # raise ValueError('Could not verify audience.') # If auth request is from a G Suite domain: # if idinfo['hd'] != GSUITE_DOMAIN_NAME: # raise ValueError('Wrong hosted domain.') # ID token is valid. Get the user's Google Account ID from the decoded token. userid = idinfo['sub'] except ValueError: # Invalid token pass
The verify_oauth2_token
function verifies the JWT
signature, the aud
claim, and the exp
claim.
You must also verify the hd
claim (if applicable) by examining the object that
verify_oauth2_token
returns. If multiple clients access the
backend server, also manually verify the aud
claim.
Calling the tokeninfo endpoint
An easy way to validate an ID token signature for debugging is to
use the tokeninfo
endpoint. Calling this endpoint involves an
additional network request that does most of the validation for you while you test proper
validation and payload extraction in your own code. It is not suitable for use in production
code as requests may be throttled or otherwise subject to intermittent errors.
To validate an ID token using the tokeninfo
endpoint, make an HTTPS
POST or GET request to the endpoint, and pass your ID token in the
id_token
parameter.
For example, to validate the token "XYZ123", make the following GET request:
https://oauth2.googleapis.com/tokeninfo?id_token=XYZ123
If the token is properly signed and the iss
and exp
claims have the expected values, you will get a HTTP 200 response, where the body
contains the JSON-formatted ID token claims.
Here's an example response:
{ // These six fields are included in all Google ID Tokens. "iss": "https://accounts.google.com", "sub": "110169484474386276334", "azp": "1008719970978-hb24n2dstb40o45d4feuo2ukqmcc6381.apps.googleusercontent.com", "aud": "1008719970978-hb24n2dstb40o45d4feuo2ukqmcc6381.apps.googleusercontent.com", "iat": "1433978353", "exp": "1433981953", // These seven fields are only included when the user has granted the "profile" and // "email" OAuth scopes to the application. "email": "testuser@gmail.com", "email_verified": "true", "name" : "Test User", "picture": "https://lh4.googleusercontent.com/-kYgzyAWpZzJ/ABCDEFGHI/AAAJKLMNOP/tIXL9Ir44LE/s99-c/photo.jpg", "given_name": "Test", "family_name": "User", "locale": "en" }
If you are a G Suite customer, you might also be interested in the hd
claim, which indicates the hosted domain of the user. This can be used to restrict access
to a resource to only members of certain domains. The absence of this claim indicates
that the user does not belong to a G Suite hosted domain.
建立帳戶或工作階段
驗證權杖後,請檢查使用者資料庫中是否已有使用者。如果是這樣,請為使用者建立經過驗證的工作階段。如果使用者尚未儲存在您的資料庫中,請透過 ID 權杖酬載中的資訊建立新的使用者記錄,然後為使用者建立工作階段。在應用程式中偵測到新建立的使用者時,您可以要求使用者提供任何其他必要的設定檔資訊。
採用跨帳戶防護功能保護使用者
當您利用 Google 服務來登入使用者時,系統會自動享有 Google 為保護使用者資料而建立的所有安全性功能和基礎架構。然而,萬一使用者的 Google 帳戶遭到入侵,或是發生其他重大安全性事件,也可能導致應用程式遭受攻擊。如要進一步保護帳戶不受重大重大事件侵擾,請使用跨帳戶防護功能接收 Google 的安全性警示。收到這類事件時,您可以進一步瞭解使用者的 Google 帳戶安全性有重大異動,並採取行動採取行動以保護帳戶。