davidep87 / passport-token-google Goto Github PK

According to google developer guide:
https://developers.google.com/identity/sign-in/web/backend-auth

The id is returned in the payload as sub. A small fix is needed in strategy.js as
profile.id = json.id || json.sub;

GoogleTokenStrategy.prototype.userprofile becomes something like

GoogleTokenStrategy.prototype.userProfile = function(accessToken, done) {
  var profileUrl = 'https://www.googleapis.com/oauth2/v3/tokeninfo?id_token='+accessToken;
  this._oauth2.get(profileUrl, null, function (err, body, res) {
    if (err) { return done(new InternalOAuthError('failed to fetch user profile', err)); }

    try {
      var json = JSON.parse(body);

      var profile = { provider: 'google' };
      profile.id = json.id || json.sub;
      profile.displayName = json.name;
      profile.name = { familyName: json.family_name,
                       givenName: json.given_name };
      profile.emails = [{ value: json.email }];

      profile._raw = body;
      profile._json = json;

      done(null, profile);
    } catch(e) {
      done(e);
    }
  });
}

Sent a pull request for the fix.

Hello, i spent some time debugging why this wasn't working and I found out that this line:
var profileUrl = 'https://www.googleapis.com/oauth2/v3/tokeninfo?id_token='+accessToken;
should actually be
var profileUrl = 'https://www.googleapis.com/oauth2/v3/tokeninfo?access_token='+accessToken;

Maybe the google api has changed? Id token does nothing and it fails with an unauthorized code.

Edit: Actually, I confused the id_token with the access_token. The module expects an id_token apparently. You should update the documentation to specify that the id_token should be used or use the https://www.googleapis.com/oauth2/v3/userinfo?access_token= url.

According to the readme, any requests to authenticate require a access_token parameter. However, the profileUrl has a parameter of id_token. Passing in an access token does not work.

CodeRef:
GoogleTokenStrategy.prototype.userProfile = function(accessToken, done) { var profileUrl = 'https://www.googleapis.com/oauth2/v3/tokeninfo?id_token='+accessToken; this._oauth2.get(profileUrl, null, function (err, body, res) {...