google-oauth

Using Postman to access OAuth 2.0 Google APIs

by

Postman will query Google API impersonating a Web Application Generate an OAuth 2.0 token: Ensure that the Google APIs are enabled Create an OAuth 2.0 client ID Go to Google Console -> API -> OAuth consent screen Add getpostman.com to the Authorized domains. Click Save. Go to Google Console -> API -> Credentials Click ‘Create … Read more

Google Authenticator available as a public service?

by

The project is open source. I have not used it. But it’s using a documented algorithm (noted in the RFC listed on the open source project page), and the authenticator implementations support multiple accounts. The actual process is straightforward. The one time code is, essentially, a pseudo random number generator. A random number generator is … Read more

How can I verify a Google authentication API access token?

by

For user check, just post get the access token as accessToken and post it and get the response https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=accessToken you can try in address bar in browsers too, use httppost and response in java also response will be like { “issued_to”: “xxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com”, “audience”: “xxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com”, “user_id”: “xxxxxxxxxxxxxxxxxxxxxxx”, “scope”: “https://www.googleapis.com/auth/userinfo.profile https://gdata.youtube.com”, “expires_in”: 3340, “access_type”: “offline” } The … Read more

Why do access tokens expire?

by

This is very much implementation specific, but the general idea is to allow providers to issue short term access tokens with long term refresh tokens. Why? Many providers support bearer tokens which are very weak security-wise. By making them short-lived and requiring refresh, they limit the time an attacker can abuse a stolen token. Large … Read more