This project is no longer actively maintained, and remains here as an archive of this work.

This sample demonstrates how to verify that the ID tokens and access tokens that you receive on your server are valid. This process is important to perform when your app must send tokens to your server but is unable to use the one-time-code flow for securely getting tokens for your server.

ID tokens and access tokens are sensitive and can be misused if intercepted. You must ensure that these tokens are handled securely by only transmitting them over HTTPS and only via POST data or within request headers. If you store them on your server, you must also store them securely.

The following are common situations where you might send tokens to your server:

• Sending ID tokens with requests that need to be authenticated. For example, if you need to pass data to your server and you want to ensure that particular data came from a specific user.
• Sending client-side access tokens to the server so that the server can make requests to the Google APIs and when the one-time-code flow is not available. For example, if your iOS app has a back-end server that needs to request data from the APIs and then background process it on behalf of the client.

All tokens need to be verified on your server unless you know that they came directly from Google. Any token that you receive from your client apps must be verified.

• Python 2.7

Requirements that are installed as part of this sample:

• Flask
• Flask-KVSession
• Google APIs Client Library for Python

Create a Google APIs Console project, OAuth 2.0 client ID, and register your JavaScript origins:

1. In the Google APIs Console, select Create from the pull-down menu on the left, and enter a project name (such as "Sample").

2. In the Services pane, enable the Google+ API and any other APIs that your app requires.

3. In the API Access pane, click Create an OAuth 2.0 Client ID.

   1. In the Product name field, enter a name for your application (such as "Sample"), and click Next. Providing a product logo is optional.
   2. In the Client ID Settings section, do the following:
      • Select Web application for the Application type.
      • Click the more options link.
      • In the Authorized Redirect URIs field, delete the example URI.
      • In the Authorized JavaScript Origins field, add the first of the following URLs for development. The last example is of a production URL.
        • https://localhost:4567
        • https://mysite.example.com
      • Click the Create client ID button.

4. In the API Access pane, locate the section Client ID for web applications and note or copy the Client ID and Client secret that you will need later to run the sample

1. Get the latest version of the token verification app. One way is to use git to clone the application repository.

    git clone https://github.com/googleplus/gplus-verifytoken-python.git
   

   Or, download the application as a zip file, and extract the library and sample code:

    wget https://github.com/googleplus/gplus-verifytoken-python/archive/master.zip
    unzip gplus-verifytoken-python-master.zip
   

2. Change directory into the sample app

    cd gplus-verifytoken-python
   

3. Install the requirements of this token verification app

    pip install -r requirements.txt
   

4. Edit client_secrets.json, and replace YOUR_CLIENT_ID with the values that you generated in Step 1.

After you set up your Google API project and configure the sample app, the app is ready to run.

Because you registered https://localhost:4567 as an Authorized JavaScript origin in the Google APIs Console, you will run the sample from that location.

1. Run the Python token verification app:

    python verify.py
   

2. Browse to your token verification app, which by default is at https://localhost:4567.

You should use the one-time-code flow to get your server its own access tokens and refresh tokens for the user. This one-time-use code is exchanged for tokens and then becomes immediately invalid. It can only be exchanged by servers that have the correct client ID and client secret. These two aspects of the one-time-code flow provide significantly more security over the exchange of tokens with a server.

One-time-code flow is available for web apps and Android apps:

• Android
• Web