Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

Question

I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user authenticates at Google login page, my OAuth2 library gets his/her email address from Google's profile API and I use that email address to mark him/her in my application as authenticated (logged in) by sending him/her a signed authentication token for future authorized requests. My question is this model safe and secure? Would it be possible for an attacker to get authorized in my application by tampering the Google response by injecting a custom email address inside the Google Profile response? Is it safe to rely only on the email address obtained by calling Google Profile API? Any additional security measures can be taken?

Answer 1

It should be ok. It sounds like you are implementing OpenID which is built on top of OAuth.

When the user authenticates to Google a token is passed back to your application via a redirect performed by the user's browser. This could be viewed or modified by the user or by anyone who can intercept the request ie a corporate proxy server performing https inspection.

When your application receives this token it sends it on to Google who verify that it was issued to your application and returns the user data you refer to. This can only be intercepted if your connection to Google is man-in-the-middled, something that is a lot less likely.