6

I'm trying to create a rest api for a service I'm working on. The service has two parts to it - the website and the mobile client. Basically, the mobile device keeps its location up to date via the api, the website displays the data via the api.

Seeing as my application only targets Android, I'm hoping to use 'Sign in with Google' as the authentication mechanism for both the mobile and website clients.

The API is using Node.js and Express.js. I'm running into trouble when generating new user accounts though. Seeing as I don't want to trust data from the client, my expected sign up process was something like this:

Through the website:

  1. User visits website, hits 'Sign up with Google'.
  2. User accepts the app request to see their Google details.
  3. Website gets a google auth token back, which it sends to the api.
  4. API contacts google with that auth token to get the user details.
  5. API creates a new user in the database along with my own form of access token.
  6. API returns my own access token to the client for future request signing.

Through the Android app:

  1. User downloads the app, runs and hits 'Sign up with Google'.
  2. User accepts authorisation step presented by google.
  3. App gets a token, which it sends to the API.
  4. API contacts google with that auth token to get the user details.
  5. API realises the user exists and registers this new device with that user.
  6. API returns my own access token to the app for future request signing.

I'm running into a lot of trouble here as soon as the token gets to the server though. Every time I use the token generated, I just get an error 'Invalid Credentials'.

Initially I started to use Passport.js, but what I found was this. In the documentation it states setup happens like so:

passport.use(new GoogleStrategy({
   returnURL: 'http://www.example.com/auth/google/return',
   realm: 'http://www.example.com/'
},
function(identifier, profile, done) {
   User.findOrCreate({ openId: identifier }, function(err, user) {
      done(err, user);
   });
}));

But when I log the contents of 'identifier' it is actually something like

https://www.google.com/accounts/o8/id?id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

I assume the ID is something unique to me but I can't seem to discover exactly what it is. Furthermore I don't know if it is time-limited or will last forever. As a final problem, I don't even know if I can get that same value when signing up via Android because I don't know where the value comes from. It's not the kind of API access token that I was expecting. When I output the contents of profile, it's just my name and email address - nothing that I can use for contacting the Google API with to verify the user.

The above solution I don't like anyway because it means the server hosting the client site has to make an api request in order to pass the id to the api. Or it sends the id details to the client so that it can pass them on to the api server. Or, the website server puts it into the api database, which is also a bad solution.

So next I figured I would use the javascript library from the Google sign in docs. I have something like this:

Website Client:

<script type="text/javascript">
function createUser(token)
{
     $.ajax({
       url:"http://api.example.com/user",
       dataType: 'jsonp',
       data: 'token='+token,
       success:function(json){
          alert("Success: "+json);
       },
       error:function(jqXHR, textStatus, errorThrown){
          alert("Error "+textStatus+" "+errorThrown);
       }
     });
}

function signinCallback(authResult)
{
  if(authResult['access_token'])
  {
    document.getElementById('signinButton').setAttribute('style', 'display: none');

    alert('RES: '+JSON.stringify(authResult));
    createUser(authResult['access_token']);
  }
  else if(authResult['error'])
  {
    alert('There was an error: ' + authResult['error']);
  }
}
</script>

Node API user handling function: function(req, res) { var callback = req.query.callback; if(callback == null) { res.send("{valid:false}"); } else { var token = req.query.token;

        if(token == null)
        {
           res.send("{valid:false}");
        }
        else
        {
           var oauth2Client = new OAuth2Client('xxxxxx', 'xxxxxx', '');

           oauth2Client.credentials = {
              access_token: token
           };

           googleapis
              .discover('plus', 'v1')
              .execute(function(err, client){
                 if(client == null)
                 {
                    console.log("Client is null");
                 }
                 else
                 {
                    var request1 = client.plus.people.get({ userId: 'me' })
                    .withApiKey('xxxxxx');

                    request1.execute(function(err, result){
                       console.log("Result: " + (err ? err.message : result.displayName));
                    });
                 }
       });
           res.set('Content-Type', 'text/javascript');
           res.send(callback+"({ret:'User Test'});");
        }
     }
  }

This works fine on the client side - I see the alert box with my access token and some other details. The trouble is that when I call the google api functions on my api server for getting the user details, I get 'Invalid Credentials' returned. I assume this is because I generated the access token in javascript for a website and I'm using it from somewhere else.

So, that pretty much leaves me out of ideas. Is there an easy way to achieve this that I'm missing? I just want to be able to generate a token from a website and from an Android app that I can use on the server for validating the user's details. The generated token doesn't even need to work on the website or the Android app, just from the api server. The API server can't do the process of directing the user to Google for authorisation though because the user doesn't directly interact with it.

4

0 回答 0