0

I have a users table in my SPA application (Phoenix API application) which contains the fields: name, email, registered_at, role_id. I use OAuth2 authentication by Google API. After the end-user authenticates at Google login page, my OAuth2 library gets his/her email address from Google's profile API and I use that email address to mark him/her in my application as authenticated (logged in) by sending him/her a signed authentication token for future authorized requests. My question is this model safe and secure? Would it be possible for an attacker to get authorized in my application by tampering the Google response by injecting a custom email address inside the Google Profile response? Is it safe to rely only on the email address obtained by calling Google Profile API? Any additional security measures can be taken?

1

It should be ok. It sounds like you are implementing OpenID which is built on top of OAuth.

When the user authenticates to Google a token is passed back to your application via a redirect performed by the user's browser. This could be viewed or modified by the user or by anyone who can intercept the request ie a corporate proxy server performing https inspection.

When your application receives this token it sends it on to Google who verify that it was issued to your application and returns the user data you refer to. This can only be intercepted if your connection to Google is man-in-the-middled, something that is a lot less likely.

  • Thanks for clarification, I understand from what you'he said that the code returned by Google can only be used by my application (identified by client_id and possibly gets email address of the OAuth2 authenticated user from Google Profile only by supplying also the client's API secret), correct? If this is the case, then this is in fact pretty safe. – W.M. Nov 19 '17 at 10:07
  • 1
    That's right. Someone man-in-the-middling the user can pretend to be the user (and indeed steal their google credentials) but your server to google connection prevents them from impersonating a different user – ste-fu Nov 19 '17 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.