Google Auth Token Validator

The Google Sign-In API gives OAuth2 JSON Web Tokens (JWT) as response data upon user sign-in. A necessary step for a service provider to trust such a token is validatation. Accepting the token without validation would allow a malicious client to simply assert itself in your system.

Google provides libraries in several languages to accomplish this, as well as an API endpoint that can outsource the task to Google's own servers (thereby introducing an additional network round trip into every authentication step), but a Ruby implementation is missing. This gem fills that gap.

Add this line to your application's Gemfile:

gem 'google-auth-token_validator'

And then execute:

$ bundle

Or install it yourself as:

$ gem install google-auth-token_validator

require "googleauth/token_validator"

client_id = "<your client ID>"
id_token = "<user's ID token>"

begin
  valid = Google::Auth::TokenValidator.new(id_token, client_id).validate
rescue Google::Auth::TokenValidator::Error => e
  puts e.message
  valid = false
end

if valid
  # trust this token
end

After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

This gem uses dotenv to set up the test environment. To enable local testing, you'll need to set up the following -

NOTE: it is not recommended to use your real account for this. Instead use a test user.

Use the Google Cloud Console to set up an OAuth id/secret pair for use with testing.

Bug reports and pull requests are welcome on the repo.

The gem is available as open source under the terms of the MIT License.