flutter google sign in, getting id token for backend server authetication

[Danny Hui]

Hi All,

I am using the flutter  google sign in plugin for social login with backend server(by OAuth 2).

As suggested by google(https://developers.google.com/identity/sign-in/web/backend-auth), 

I should use the verifiable ID tokens to securely get the user IDs of signed-in users on the server side

I tried to use the flutter google sign in to get the id token as follows : 

google_sign_in: "^3.0.4"

I simply follow the document and get the 

GoogleSignIn _googleSignIn = new GoogleSignIn(
  scopes: [
    'email',
    'openid',
    'profile',
    'https://www.googleapis.com/auth/contacts.readonly',
  ],
);

_googleSignIn.signIn().then<void>((GoogleSignInAccount googleSignInAccount) {

  googleSignInAccount.authentication.then<void>((GoogleSignInAuthentication googleSignInAuthentication) {

I find that it is not able to retrieve the id token.

After studying the comment in https://github.com/flutter/flutter/issues/16613 ,

I add the flutter firebase plugin to my project.

firebase_auth: "^0.5.14"

I assume that my config(including the google-services.json) should be correct because I finally get the id token from googleSignInAccount and firebaseUser as follow : 

_googleSignIn.signIn().then<void>((GoogleSignInAccount googleSignInAccount) {
  googleSignInAccount.authentication.then<void>((GoogleSignInAuthentication googleSignInAuthentication) {
    _auth.signInWithGoogle(idToken: googleSignInAuthentication.idToken, accessToken: googleSignInAuthentication.accessToken).then((FirebaseUser firebaseUser) {
      firebaseUser.getIdToken(refresh: true).then((String idToken) {
        print('id token =$idToken');
      }, onError: (Object error) {
        print('error in fetching firebase user id token. error=$error');
      });

However, I find that the googleSignInAccount's idToken is invalid : 

https://www.googleapis.com/oauth2/v1/tokeninfo?id_token=XYZ

https://www.googleapis.com/oauth2/v2/tokeninfo?id_token=XYZ

https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ

, where the XYZ is the googleSignInAccount's idToken.

Here is the exception from google : 

{
 "error_description": "Invalid Value"
}

I also test it in verification APIs in backend server : 

<dependency>
  <groupId>com.google.apis</groupId>
  <artifactId>google-api-services-oauth2</artifactId>
</dependency>

It is invalid.

I think this problem is just similar to the post : https://stackoverflow.com/questions/35662357/google-sign-in-for-android-invalid-id-token

Then, I tried to the firebaseUser's idToken instead. However, it doesn't work as well.

In my backend server verification, 

<dependency>
  <groupId>com.google.firebase</groupId>
  <artifactId>firebase-admin</artifactId>
  <version>6.3.0</version>
</dependency>

Here is the exception

com.google.firebase.auth.FirebaseAuthException: Firebase ID token isn't signed by a valid public key. See https://firebase.google.com/docs/auth/admin/verify-id-tokens for details on how to retrieve an ID token.

I think my token is signed with the public key and is not expired because I can see the details in https://jwt.io/ 

Header : 

{

  "alg": "RS256",

  "kid": "b89f7346a0985f421dcd8d30c0b30eebfae19a1e"

}

The kid is just the same as the one defined in https://www.googleapis.com/robot/v1/metadata/x509/secur...@system.gserviceaccount.com

1) Am I doing anything wrong in getting the id token for my backend server authentication?

2) Why the googleSignInAccount's idToken is invalid but that can be used in flutter firebase auth? 

3) Why the firebaseUser's idToken isn't signed by a valid public key?

4) Should I just pass the access token to my backend server instead and verify the azp and aud?

ref. : https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=ABC

Thanks!

[Danny Hui]

Hi All, 

Sorry for the wrong reference of https://stackoverflow.com/questions/35662357/google-sign-in-for-android-invalid-id-token

it should be https://stackoverflow.com/questions/51320271/error-description-invalid-value-for-token-google-sign-in-every-time-using-f

Thanks!

The kid is just the same as the one defined in https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com

[Danny Hui]

I finally find that the dart print('id token =$idToken'); function cannot output the whole id token string in my console output..

_googleSignIn.signIn().then<void>((GoogleSignInAccount googleSignInAccount) {
  googleSignInAccount.authentication.then<void>((GoogleSignInAuthentication googleSignInAuthentication) {
    _auth.signInWithGoogle(idToken: googleSignInAuthentication.idToken, accessToken: googleSignInAuthentication.accessToken).then((FirebaseUser firebaseUser) {
      firebaseUser.getIdToken(refresh: true).then((String idToken) {
        print('id token =$idToken');
      }, onError: (Object error) {
        print('error in fetching firebase user id token. error=$error');
      });

This token is enough for my backend authentication accessing Google API.

On Tuesday, July 24, 2018 at 9:47:27 AM UTC+8, Danny Hui wrote:

The kid is just the same as the one defined in https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com

[Sam Dzirasa]

Hi Danny:

Are you actually able to get googleSignin working.

My app fails every time with error 'sign_in_failed' DEVELOPER ERROR.  I have added my SHA1 to my app in the Firebase console and added the corresponding google-services.json  to my flutter app.

I am using these 2 imports

import 'package:firebase_auth/firebase_auth.dart';

import 'package:google_sign_in/google_sign_in.dart';

Just curious: -- Did you have to do anything else in setup to get google (gmail) signin to work?  I get the sign-in screen but after signing in I get the error.

Sam

[Danny Hui]

Hi Sam,

Yes, I am actually able to get googleSignIn working.

May I know what is your error?

[Danny Hui]

Hi Sam,

Apart from adding the SHA1, you may also need to enter the Firebase console to turn on the service : Authentication > Login method > Google.

Regards!

On Wednesday, August 1, 2018 at 11:12:56 AM UTC+8, Sam Dzirasa wrote:

[Steve]

Hi,

did it follow this
https://github.com/flutter/plugins/blob/master/packages/google_sign_in/example/lib/main.dart

onCurrentUserChanged.listen method?

Best Regards!

[Agri Kridanto]

Hai Danny ,  i have same problem ... i just got id token from google sign in, but when i verify with tokeninfo endpoint , it says 'invalid value'...

Then i'm trying using firebase auth , same result... Maybe you can give some suggestions ? Thanks...

[Laerti Papa]

I also have the same issue. I had to sent sent access_token instead.