Invalid token from google_sign_in plugin when verifying on server side

user_3572546 0
Viewed 1771

Please i am trying to implement social authentication on my flutter app with plugin google_sign_in plugin. It works properly on the client side and retrieves the account details of the user.
My problem is that i want to save the user in my database, so i need to verify the id_token gotten at the server side. I tried doing this with the google API library on the server side as shown here, but i key getting an invalid token result. I finally decided to try the tokeninfo endpoint https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=<my_token> which should return 200 response with a body containing the user details and other info, but i get a 400 response with the body {"error_description": "Invalid Value"}.
I decoded the token with jwt.io to make sure it isn't an expired token and the token was still very much valid.

This is the google_sign_in code i used on flutter to get the id_token. 

GoogleSignIn _googleSignIn = new GoogleSignIn(
    scopes: <String>[ 
      'profile',
      'email',
      'https://www.googleapis.com/auth/contacts.readonly',
    ],
  );

  Future<Null> _handleSignIn() async {
    try {
      _googleSignIn.signIn().then((result){
          result.authentication.then((googleKey){
              print(googleKey.accessToken);
              print(googleKey.idToken);
              print(_googleSignIn.currentUser.displayName);
          }).catchError((err){
            print('inner error');
          });
      }).catchError((err){
          print('error occured');
      });
      print('signed in .....');
    } catch (error) {
      print(error);
    }
  }

Please any help would be greatly appreciated.

google-signin dart flutter
2 Answers

It turns out the tokens were valid all along. The tokens get truncated on the command line and become invalid.
The way I test the validity now is to use an HTTP package to test without having to copy the token.
eg. 

 Dio dio = new Dio();
 Response response = await dio.get('https://www.googleapis.com/oauth2/v1/tokeninfo?id_token='+googleKey.idToken);
 print(response.data); //contains the token info
user_35725460

In document google_sign_in they have detail for IOS, but in Android they have missing those step:

  1. Add

classpath 'com.google.gms:google-services:4.2.0'

in dependencies in your root "build.gradle"

  1. Add

apply plugin: 'com.google.gms.google-services'

in bottom your "app/build.gradle"

  1. Add

implementation "com.google.gms:google-services:4.2.0"

in dependencies in "app/build.gradle"

  1. Go to your firebase console, download

google-services.json

And copy it to directory "app/"

After complete all those step you can run and get idToken normal

user_91302150
Related