I have been creating a Google login in my website. This is my code:
function gmailLogin(userInfo)
{
//geting the id_token
var token_id = gapi.auth2.getAuthInstance().currentUser.get().getAuthResponse().id_token;
jQuery.ajax({
url: "functions/login_check.php",
type: "post",
data: {token_id: token_id},
success: function(data)
{
//do something if success
$('#console').html(data);
}
});
}
I use PHP curl to verify account by this id_token and everything works fine.
This is my php code:
//token I got from the page previously using ajax
$token_id = $_POST['token_id'];
$verifyResponse = file_get_contents('https://oauth2.googleapis.com/tokeninfo?id_token='.$token_id);
$response = json_decode($verifyResponse);
if(isset($response->email_verified))
{
//do stuff
}
However, since the id_token remains same forever. It can cause security loop-holes. Is there any way to reset this id_token using PHP or Javascript? If not, is there any other way to implement this login system easily (without any external libraries & in php)?
The id_token is a JWT with short life time. Google set it to 1 hour. You can verify it by taking the JWT and put it on https://jwt.io.
The openid configuration of google is there : https://accounts.google.com/.well-known/openid-configuration. You a have a revocation endpoint to do what you need.
In your php code, I don't see the verification you have to do on the id_token :
if you don't want to do theses verifications on your PHP code (because allready done with the js api of google), don't send the id_token to the backend. Send the access_token. It' has the same life time of the id_token. You can use it to get the user informations with the end point userinfo. You can revoke it as well.
The life time of the tokens must not be a problem for a web application. After authentication with google, and verify the informations of the tokens, your app need use session and work with it.