CODEWITHSUNDEEP
google-apigoogle-oauthgoogle-identity
Gandalf
Gandalf

Reputation: 13693

Decoding jwt token returned by the new google identity api

I have created a login button with google identity javascript api https://developers.google.com/identity/gsi/web/guides/display-button#javascript

I have successfully returned a jwt token and decoded it successfully. I have a field in the jwt token called kid and the docs say this is its purpose

the thumbprint for the public key used to verify this token

Will the kid field always be the same for the email i logged in with and can it ever change?

I am looking to extract a field from the jwt that will never change so that i can track users who have logged in on web and on android apps.

Upvotes: 1

Views: 2326

Answers (2)

Vince
Vince

Reputation: 31

you can use base64url_decode function to decode your jwt like that, I had the similar problem that I've solve like that in symfony 5.3:

$jwt = $request->request->get('credential');
$match=explode('.',$jwt);

function base64url_decode($base64url)
{
   $base64 = strtr($base64url, '-_', '+/');
   $plainText = base64_decode($base64);
    return ($plainText);
}
  $payload=base64url_decode($match[1]);
  $payloadObject=json_decode($payload);

$verif = $payloadObject->email_verified;
$email = $payloadObject->email;

...etc

Upvotes: 2

Linda Lawton - DaImTo
Linda Lawton - DaImTo

Reputation: 117016

Run the id token through Jwt.io The payload data should look something like this.

{
  "iss": "accounts.google.com",
  "azp": "1046123799103-q2fg15qscp8apoh8fcf490o3d0bk.apps.googleusercontent.com",
  "aud": "1046123799103-q2fg15qscp8apoh8fcf490o3d0bk.apps.googleusercontent.com",
  "sub": "117200475532672775346",
  "email": "[email protected]",
  "email_verified": true,
  "at_hash": "LqL3dnsD9w-elE-unya7-g",
  "iat": 1662038461,
  "exp": 1662042061
}

In this example the sub is the users internal id on google.

If i run it though the token info endpoint

https://oauth2.googleapis.com/tokeninfo?id_token=Id_token

I get the same sub claim

{
  "iss": "accounts.google.com",
  "azp": "1046123799103-q2fg15qscp8apoh8fcf490o3d0bk.apps.googleusercontent.com",
  "aud": "1046123799103-q2fg15qscp8apoh8fcf490o3d0bk.apps.googleusercontent.com",
  "sub": "117200475532672775346",
  "email": "[email protected]",
  "email_verified": "true",
  "at_hash": "M_28bzozJTabf3e8Q1yyeQ",
  "iat": "1662045590",
  "exp": "1662049190",
  "alg": "RS256",
  "kid": "402f305b70581329ff289b5b3a67283806eca893",
  "typ": "JWT"
}

Sub claim is normally used for account linking between the internal user system of a site and the external third party logins.

Upvotes: 3

Related Questions