OpenID Connect Login Persistence

Viewed 32

I'm trying to implement Google OpenID Connect to log users in to my website.

I'm using React, Koa, a DB (to maintain user data specific to my application), and trying to incorporate Passportjs's Google OIDC Strategy for a token(JWT)-based authentication (no session ID/DB).

I have a few questions regarding the flow:

  1. Despite the user using Google to login, the user's session with Google is separate from the user's session with my application, right? So, after the authorization code exchange for the ID token (user was successfully authenticated by Google), how do I keep the login persistent for the user on my application? What should I do with the ID token? For example, after using the user's email in the ID token to query my DB of users to find the user, how do I persist the user's login in my application?

  2. Concerning the user information I need, I only need the user's name, email, and picture, which are all included in the ID Token. The OpenID Connect protocol also returns an Access Token (as OAuth2.0 is underlying). But I don't think I need to use it since I don't need to get anything from Google's resource server since I only want to log the user in to my application. Should I just leave it?

Here's an example of Google's ID token payload.

// ID token payload example

{
  "iss": "https://accounts.google.com", // The JWT's issuer
  "nbf":  161803398874,
  "aud": "314159265-pi.apps.googleusercontent.com", // Your server's client ID
  "sub": "3141592653589793238", // The unique ID of the user's Google Account
  "hd": "gmail.com", // If present, the host domain of the user's GSuite email address
  "email": "elisa.g.beckett@gmail.com", // The user's email address
  "email_verified": true, // true, if Google has verified the email address
  "azp": "314159265-pi.apps.googleusercontent.com",
  "name": "Elisa Beckett",
                            // If present, a URL to user's profile picture
  "picture": "https://lh3.googleusercontent.com/a-/e2718281828459045235360uler",
  "given_name": "Elisa",
  "family_name": "Beckett",
  "iat": 1596474000, // Unix timestamp of the assertion's creation time
  "exp": 1596477600, // Unix timestamp of the assertion's expiration time
  "jti": "abc161803398874def"
}
0 Answers
Related