Google Auth Token Validator

The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in. A necessary step for a service provider to trust such a token is validatation. Accepting the token without validation would allow a malicious client to simply assert itself in your system.

Google provides libraries in several languages to accomplish this, as well as an API endpoint that can outsource the task to Google's own servers (thereby introducing an additional network round trip into every authentication step), but a Ruby implementation is missing. This gem fills that gap.

Installation

Add this line to your application's Gemfile:

gem 'google-auth-token_validator'

And then execute:

$ bundle

Or install it yourself as:

$ gem install google-auth-token_validator

Usage

require "googleauth/token_validator"

client_id = "<your client ID>"
id_token = "<user's ID token>"

begin
  valid = Google::Auth::TokenValidator.new(id_token, client_id).validate
rescue Google::Auth::TokenValidator::Error => e
  puts e.message
  valid = false
end

if valid
  # trust this token
end

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

This gem uses dotenv to set up the test environment. To enable local testing, you'll need to set up the following -

Key	Description
TEST_CLIENT_ID	A Google OAuth client ID, used to compare ID tokens against
TEST_CLIENT_SECRET	A Google OAuth client secret, used to authorize token refreshes
REFRESH_TOKEN	A refresh token for a test user. It is recommended to use the Google OAuth Playground to generate one

NOTE: it is not recommended to use your real account for this. Instead use a test user.

Use the Google Cloud Console to set up an OAuth id/secret pair for use with testing.

Contributing

Bug reports and pull requests are welcome on the repo.

License

The gem is available as open source under the terms of the MIT License.