I have implemented Google login (OAuth2) login on my website. It matches users by e-mail, i.e. if your e-mail is the same in Google as in our system, and you have Google Auth enabled on my website, you are logged in.

Should I enable it for everyone by default? I want to do it on the assumption someone controls Google account, they control the associated e-mail account, and therefore they already have access to the user account on my website (since I implement password reset by e-mail).

Are there any security implications that I should be aware of?

  • I really don't see a security compromise per say. Really the only vulnerability would be unauthorized access by 3rd party. Possible cookie hijacking? Make sure your site is compliant with security standards. – Cameron Verotti Dec 16 '15 at 21:33
  • This would allow Google (or someone having compromised Google) to impersonate any of your users. I'd say this is a really bad idea unless users explicitly enable it during registration. – André Borie Dec 17 '15 at 17:02

oAuth is not an authentication mechanism. It handles authorization to access resources (usually an API).

From RFC 6749:

The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.

It is however also used by some as a way to authenticate users. You must trust that service because it has the keys to your resources (as opposed to allowing you to access their resources, with the agreement of their user - which is what oAuth is for)

Wikipedia points out the differences between oAuth and OpenID (which is an authentication protocol).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.