0

I'm having a hard time wrapping my head around how to authenticate a user in my REST service. I plan to use Google Sign-in (on Android, namely). I can't quite figure out how to authenticate users on my server. I do not want to have any authorizations (other than validating the identity of the user), all I want to do is when I receive a request, validate that the user is who he (or she) says he is.

My understanding is that the user will login, get some sort of token from Google, then send that token along his request to my server which I will use to validate his identity. However, from what I read, the user will encode their requests in a JWT (json web token), which I will then use to validate their identity without ever talking to the Google server directly. Did I understand properly?

On Google's documentation, it says

If you do not require offline access, you can retrieve the access token and send it to your server over a secure connection. You can obtain the access token directly using GoogleAuthUtil.getToken() by specifying the scopes without your server's OAuth 2.0 client ID.

But it does not say what the server should do with the token.

Nepoxx
  • 4,849
  • 5
  • 42
  • 61

1 Answers1

1

You have an android app which enables user to log in via Google+ Sign-In, and then this Android app will call your REST API. What you want is how your service authenticates this request. This Android client will send request to your service with token, and you need to validate this token for authentication. Is my understanding right?

If so, you need to validate the token sent to your service. The reference you mentioned is for Google API calls, in your case; it's your own service API call. For the Android side, just follow the reference, in your service side you can use TokenInfo validation to authenticate users.

Owen Cao
  • 7,955
  • 2
  • 27
  • 35
  • That's exactly what I was looking for. I couldn't figure out how to validate the token (and therefore authenticate the identity of the user). Do you know if I should still be using an anti-forgery token however as documented [here](https://developers.google.com/+/web/signin/server-side-flow#step_2_create_an_anti-request_forgery_state_token)? – Nepoxx Jul 15 '14 at 12:49
  • Yes, although `state` is RECOMMENDED not REQUIED, this parameter SHOULD be used for preventing cross-site request forgery. – Owen Cao Jul 16 '14 at 01:16