2

I have a chrome extension which allows users to exclusively login with google and no other provider.

In my (node + couchdb) backend I need to construct a user account from the auth Response provided by google's oauth2 api. I was thinking about using a hash of the id_token as a password after verifying the token using the tokeninfo api

I realize that the id_token changes from time to time. In that case I was hoping to update the user's password automatically.

Here is the flow I had in mind:

  1. User signs in on the front-end and gets an id_token from google
  2. Id token is sent to the server and verified using the tokeninfo api
  3. If verified, a user account is created with a password being the hash of the id_token.

Do you see any security holes with this flow? If so, what are the alternatives?

  • Why do you even need this password? – Cthulhu Aug 3 '15 at 14:17
  • @Cthulhu good question. I would ideally not like to have a password but in my predicament, I need to. Basically, in my node server I construct a couchDB user with the userId being the email address. Now, if I create the user without a password then anyone with ther user's email address could potentially login in and read the user's information. If you may wonder why the CouchDB is open to the world and not behind some firewall that is because it offers a Restful interface for authenticating users - which is what I use to ultimately authenticate them. – dipole_moment Aug 3 '15 at 14:26
  • 1
    I think we're missing some important information or at least its not very clear to me. As I understand it, users need to authenticate with Google to use your service/website. If this is the case, then users will continue needing to authenticate with Google, and nto storing a password is not a concern because you are transferring the risk to google – Purefan Aug 3 '15 at 14:37
  • @Purefan Just to be more clear, the issue is one part authentication and one part user creation. After a user authenticates with google I would like to auto-register them into my couchdb database. The main reason I need to auto-register them is because I have a pouchDB client on the Front-end which logs the user in directly to their couchdb database via credentials. This pouchDB client uses CouchDB's restful interface to authenticate the user I need to essentially then create a user account from some of the information google gives me safely. Hope this makes sense. – dipole_moment Aug 3 '15 at 14:54
1

Probably not.

The information provided by that endpoint is fairly deterministic in nature, so anyone with enough motive (e.g. has 20 minutes to kill) can guess the details and generate the same password as you for that user. Additionally, that hash will fail every time (or often enough) a new token is issued, so you need to always keep the record updated.

The basic process of registering the user works reasonably well, but what you need to do is generate the password randomly and figure out how to store it securely and send it to the client for it to use.

Now, if you can have CouchDB verify the token itself verbatim then you could just send that, but I'm guessing it doesn't have the ability to do that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.