2

So this might gonna be a newbe question.

I'm developing an REST(ful) JSON application programming interface with PHP. This API will be primarily accessed by Android-devices via an App. Due to the fact only people with G+ Accounts will use this app I want to use Google API for user-authentication. So far, so simple.

But I'm using GoogleAPI for the first time and I read interesting and needed parts of the Google API DevDocs. So I found the google-api-php-client that I'm using for now.

Here is how I thought this auth-process works:

  1. User logs into G+Account on mobile device (or similar; I read something about an PlayStore ID Token or something here)
  2. The app does have a token now (like stated here (response)) "access_token":"1/fFAGRNJru1FTz70BzhT3Zg", "expires_in":3920, "token_type":"Bearer"
  3. Android-App sends Request to my PHP API like GET /meeting/:id and sends the access_token (1/fFAGRNJru1FTz70BzhT3Zg only), too.
  4. My app can take the access_token and can ask googleAPI/people/me for the ID of the user.
  5. User is identified in request on my API and the magic can go on

But there is a problem with the mentioned Google-lib for PHP: the function setAccessToken($accessToken) requires the whole JSON-response as the docs says: {"access_token":"TOKEN", "refresh_token":"TOKEN", "token_type":"Bearer", "expires_in":3600, "id_token":"TOKEN", "created":1320790426} (see here) of a auth-request to GoogleAPI.

It can't be the solution to send the whole JSON-response with id_token, refresh_token and access_token to my API on every request as this will cause huge load of traffic and I'm sure that there is a simple solution, but I don't see it.

I hope I could explain my thoughts and problems properly and I hope that my english is not that bad.

1 Answer 1

1

I just solved this.

The id_token is enough to identify the User. When the android app sends a request with the id_token in it the server can ask google for its identity.

In google-api-php-client this works with: $id_token = $_GET['id_token']; $client = new Google_Client(); $attr = $client->verifyIdToken($id_token)->getAttributes(); echo $attr['payload']['sub'];

I found this in Google API Docs (there's also a "Recommended flow"-description) and with help of one of the mentioned link in the question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.