5

I have an an app on Google App Engine with both an iOS and Android client that communicates with the server via Google Cloud Endpoints, and at some time yesterday between 19:21 and 20:24 (server time, so I assume Pacific), EVERY request to my server via Endpoints, regardless of which client it came from, has failed with:

D 2014-05-12 20:24:33.353 Checking for id_token.
D 2014-05-12 20:24:33.362 Cert cache miss
D 2014-05-12 20:24:34.705 id_token verification failed.
D 2014-05-12 20:24:34.706 Checking for oauth token.
D 2014-05-12 20:24:34.717 Oauth framework user didn't match oauth token user.

I have not made any modifications to my app since May 8th, so something must have changed on the App Engine side.

FWIW, my app uses endpoints-proto-datastore, in case that's relevant (though I doubt it is.)

This has rendered my service completely useless, and I'm not sure how to escalate this. Any tips on either how I might fix this or how I can escalate to Google?

Codiak
  • 1,832
  • 2
  • 13
  • 20
  • 1
    Hi, i have the same problem with GAE and token id from an android client. It works fine and since yesterday it fails to verify the id token. – Kay Schneider May 14 '14 at 13:03

2 Answers2

0

I too have same problem and have debugged as best I can, using Xcode debug to extract token and append to following https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=, which does validate token_id: "issuer": "accounts.google.com", "issued_to": ".apps.googleusercontent.com", "audience": ".apps.googleusercontent.com", "user_id": "*", "expires_in": 3226, "issued_at": 1400114068, ....

So it looks like GAE is issue. I'm using scope =...googleapis.com/auth/userinfo.email"; // scope for OAuth2 and there are some notes on https://developers.google.com/+/api/auth-migration#email, saying that going with timetable of 1st Sept 2014

But I don't see why it is dead now

GilesG
  • 1
0

In my case this was a bug of the GAE. Here are the issue trackers from the GAE: This ticket was fixed and now it works fine on my GAE instance. The second ticket is an "newer" ticket but with the same impact that the GAE cant can verify the token id.

Maybe it should work now on all instances :)

https://code.google.com/p/googleappengine/issues/detail?id=9188

https://code.google.com/p/googleappengine/issues/detail?id=10753

Kay Schneider
  • 311
  • 3
  • 8
  • Yep, all seems to be working now, and it was in fact something that happened on the GAE side. For future reference, this post here sat here for 24 hours without any response from Google, but when I posted on one of the tickets listed above, it got immediate attention. Moral of the story is to start there next time! – Codiak May 15 '14 at 17:49