Google Sign-In for Websites: Authentication with backends
Why Stack Overflow recommends it
Stack Overflow users link it as the official short walkthrough when answering questions about verifying Google ID tokens on a server and integrating Google Sign-In into a web app.
Recommended by 2 people across 2 different months, 2016 to 2022.
What it is
A 2-minute Chrome for Developers video showing how to use Google Sign-In on a website together with a backend server. It covers sending the user's ID token to the server so the backend can verify who the user is.
What people said
Recommends ReyAnthonyRenacia · 2017-03 · Stack Overflow · on “Codenameone Connect to Google Drive”
Check the Integrating Google Sign-In into your web app [LINK] . There's even an video guide [this video] explaining the concept. There's a quick Save to Drive [LINK] which enables your web site to allow users to save files to their Drive account from an arbitrary URL via their browser. If that's not sufficient enough, you can always check the Uploading Files [LINK] where you can upload file data by creating or updating a File resource.
Recommends Steven · 2017-05 · Stack Overflow · on “Lack of explanation to Google Sign-In documentation”
The profile ID is a static string representing the user. If you use it by itself to sign the user in on your server and issue a cookie or session, then if an attacker learns the user's ID, they could forge a sign-in request to your server and impersonate the user, stealing their data or making transactions on their behalf. On the other hand, the ID token is cryptographically-signed JSON Web Token [LINK] . By validating the token as described in the documentation, you can be sure that it came from Google and was issued to your legitimate client application. An ID token expires after an hour and the new one be different. The documentation does have a general explanation of these security conce
Cites yashhy · 2016-10 · Stack Overflow · on “google sign-in Storagerelay URI is not allowed for 'NATIVE' client type”
I have been trying this simple google sign-in by following this tutorials: [LINK] [LINK] The code is very simple and I'm exactly following the same steps as given in these tutorials, but I end up in the below error. 400. That’s an error. Error: invalid_request Storagerelay URI is not allowed for 'NATIVE' client type [LINK] In my credentials I have the configuration like below: [LINK] My Code goes like below: <meta name="google-signin-client_id" content="377345478968-2opk94iompa38gja0stu1vi821lr3rt0.apps.googleusercontent.com"> <script src=" [LINK] " async defer></script> <div id="gSignIn"></div> function onSuccess(googleUser) { var profile = googleUser.getBasicProfile(); gapi.client.
Cites elmazzun · 2018-01 · Stack Overflow · on “Is it mandatory to validate in my server the ID token with Google Sign in?”
I implemented a simple web page where Google Sign In let users enter their Gmail and password in order to authenticate; then I made a simple server with Flask using Google Python API [LINK] . Everything is working fine, but I realized that I made the server before asking myself if I really need it: if I got it right, when user's credentials are verified after clicking on Google Sign In, the user is authenticated. Client-side speaking, after a successful login a GoogleUser object is returned and it contains informations about the user; however, the user has already told me who he is since he provided me username and password. So, why bother validating on a server an ID token if it is given af
Cites Paul · 2022-01 · Stack Overflow · on “How do I design google OAuth2 workflow”
Ok, I found out, that the best and recommended way is too use GoogleTokenVerifier on the backend to authenticate and check the accessToken of the oauth request. Microsofts is recommending the same way: [LINK] [this video]