I have a users table in my SPA application (Phoenix API application) which contains the fields: name
, email
, registered_at
, role_id
. I use OAuth2 authentication by Google API. After the end-user authenticates at Google login page, my OAuth2 library gets his/her email address from Google's profile API and I use that email address to mark him/her in my application as authenticated (logged in) by sending him/her a signed authentication token for future authorized requests. My question is this model safe and secure? Would it be possible for an attacker to get authorized in my application by tampering the Google response by injecting a custom email address inside the Google Profile response? Is it safe to rely only on the email address obtained by calling Google Profile API? Any additional security measures can be taken?
1 Answer
It should be ok. It sounds like you are implementing OpenID which is built on top of OAuth.
When the user authenticates to Google a token is passed back to your application via a redirect performed by the user's browser. This could be viewed or modified by the user or by anyone who can intercept the request ie a corporate proxy server performing https inspection.
When your application receives this token it sends it on to Google who verify that it was issued to your application and returns the user data you refer to. This can only be intercepted if your connection to Google is man-in-the-middled, something that is a lot less likely.
-
Thanks for clarification, I understand from what you'he said that the code returned by Google can only be used by my application (identified by
client_id
and possibly gets email address of the OAuth2 authenticated user fromGoogle Profile
only by supplying also the client's APIsecret
), correct? If this is the case, then this is in fact pretty safe.– W.M.Nov 19, 2017 at 10:07 -
1That's right. Someone man-in-the-middling the user can pretend to be the user (and indeed steal their google credentials) but your server to google connection prevents them from impersonating a different user– ste-fuNov 19, 2017 at 10:59