I have a chrome extension which allows users to exclusively login with google and no other provider.

In my (node + couchdb) backend I need to construct a user account from the auth Response provided by google's oauth2 api. I was thinking about using a hash of the id_token as a password after verifying the token using the tokeninfo api

I realize that the id_token changes from time to time. In that case I was hoping to update the user's password automatically.

Here is the flow I had in mind:

  1. User signs in on the front-end and gets an id_token from google
  2. Id token is sent to the server and verified using the tokeninfo api
  3. If verified, a user account is created with a password being the hash of the id_token.

Do you see any security holes with this flow? If so, what are the alternatives?

  • 1
    Why do you even need this password?
    – Cthulhu
    Commented Aug 3, 2015 at 14:17
  • @Cthulhu good question. I would ideally not like to have a password but in my predicament, I need to. Basically, in my node server I construct a couchDB user with the userId being the email address. Now, if I create the user without a password then anyone with ther user's email address could potentially login in and read the user's information. If you may wonder why the CouchDB is open to the world and not behind some firewall that is because it offers a Restful interface for authenticating users - which is what I use to ultimately authenticate them. Commented Aug 3, 2015 at 14:26
  • 1
    I think we're missing some important information or at least its not very clear to me. As I understand it, users need to authenticate with Google to use your service/website. If this is the case, then users will continue needing to authenticate with Google, and nto storing a password is not a concern because you are transferring the risk to google
    – Purefan
    Commented Aug 3, 2015 at 14:37
  • @Purefan Just to be more clear, the issue is one part authentication and one part user creation. After a user authenticates with google I would like to auto-register them into my couchdb database. The main reason I need to auto-register them is because I have a pouchDB client on the Front-end which logs the user in directly to their couchdb database via credentials. This pouchDB client uses CouchDB's restful interface to authenticate the user I need to essentially then create a user account from some of the information google gives me safely. Hope this makes sense. Commented Aug 3, 2015 at 14:54
  • I know this is an old post, but it may help others searching. Looks to me what you need is to verify the ID token in your back end with the your Google OAuth2 Client instance (OAuth2Client.verifyIdToken(...)). On success that will return a payload containing not only the user's email address but also a unique sub ID which is constant (email addresses on the other hand can change without notice !). You can use the sub ID to create and/or retrieve your subject's database entry, and you have their email too ! Not sure why you need a password but you could always hash their sub ID...
    – user156220
    Commented Jul 1, 2021 at 17:25

1 Answer 1


Probably not.

The information provided by that endpoint is fairly deterministic in nature, so anyone with enough motive (e.g. has 20 minutes to kill) can guess the details and generate the same password as you for that user. Additionally, that hash will fail every time (or often enough) a new token is issued, so you need to always keep the record updated.

The basic process of registering the user works reasonably well, but what you need to do is generate the password randomly and figure out how to store it securely and send it to the client for it to use.

Now, if you can have CouchDB verify the token itself verbatim then you could just send that, but I'm guessing it doesn't have the ability to do that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .