No commit activity in last 3 years
No release in over 3 years
The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in. A necessary step for a service provider to trust such a token is validatation. Accepting the token without validation would allow a malicious client to simply assert itself in your system. Google provides libraries in several languages (https://goo.gl/jkzS18) to accomplish this, as well as an API endpoint that can outsource the task to Google's own servers (thereby introducing an additional network round trip into every authentication step), but a Ruby implementation is missing. This gem fills that gap.
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Dependencies

Development

~> 1.15
~> 0.8
~> 2.2
~> 0.10
~> 10.0
~> 3.0
 Project Readme

Google Auth Token Validator

Build Status Coverage Status Maintainability

The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in. A necessary step for a service provider to trust such a token is validatation. Accepting the token without validation would allow a malicious client to simply assert itself in your system.

Google provides libraries in several languages to accomplish this, as well as an API endpoint that can outsource the task to Google's own servers (thereby introducing an additional network round trip into every authentication step), but a Ruby implementation is missing. This gem fills that gap.

Installation

Add this line to your application's Gemfile:

gem 'google-auth-token_validator'

And then execute:

$ bundle

Or install it yourself as:

$ gem install google-auth-token_validator

Usage

require "googleauth/token_validator"

client_id = "<your client ID>"
id_token = "<user's ID token>"

begin
  valid = Google::Auth::TokenValidator.new(id_token, client_id).validate
rescue Google::Auth::TokenValidator::Error => e
  puts e.message
  valid = false
end

if valid
  # trust this token
end

Development

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

This gem uses dotenv to set up the test environment. To enable local testing, you'll need to set up the following -

Key Description
TEST_CLIENT_ID A Google OAuth client ID, used to compare ID tokens against
TEST_CLIENT_SECRET A Google OAuth client secret, used to authorize token refreshes
REFRESH_TOKEN A refresh token for a test user. It is recommended to use the Google OAuth Playground to generate one

NOTE: it is not recommended to use your real account for this. Instead use a test user.

Use the Google Cloud Console to set up an OAuth id/secret pair for use with testing.

Contributing

Bug reports and pull requests are welcome on the repo.

License

The gem is available as open source under the terms of the MIT License.