验证Google Id令牌

Question

我正在使用ASP.NET Core为Android客户端提供API.Android以Google帐户登录,并将ID令牌JWT作为承载令牌传递给API.我有应用程序工作,它确实通过了身份验证检查,但我不认为它正在验证令牌签名.

根据Google的文档,我可以将此网址称为 https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123,但我无法在服务器端找到相应的挂钩来执行此操作.另外根据Google文档,我可以以某种方式使用客户端访问API来执行此操作,而无需每次都调用服务器.

我的配置代码:

app.UseJwtBearerAuthentication( new JwtBearerOptions()
{

    Authority = "https://accounts.google.com",
    Audience = "hiddenfromyou.apps.googleusercontent.com",
    TokenValidationParameters = new TokenValidationParameters()
    {
        ValidateAudience = true,
        ValidIssuer = "accounts.google.com"
    },
    RequireHttpsMetadata = false,
    AutomaticAuthenticate = true,
    AutomaticChallenge = false,
});

如何让JWTBearer中间件验证签名？我已经接近放弃使用MS中间件并自行推出.

Answer 1

您可以通过几种不同的方式验证服务器端ID令牌的完整性:

1. "手动" - 不断下载Google的公钥,验证签名,然后是每个字段,包括iss一个; 主要优势(虽然我认为是一个小优势)我在这里看到的是,您可以最大限度地减少发送给Google的请求数量.
2. "自动" - 在Google的终端上执行GET以验证此令牌 https://www.googleapis.com/oauth2/v3/tokeninfo?id_token={0}
3. 使用Google API客户端库 - 就像官方的一样.

以下是第二个看起来如何:

private const string GoogleApiTokenInfoUrl = "https://www.googleapis.com/oauth2/v3/tokeninfo?id_token={0}";

public ProviderUserDetails GetUserDetails(string providerToken)
{
    var httpClient = new MonitoredHttpClient();
    var requestUri = new Uri(string.Format(GoogleApiTokenInfoUrl, providerToken));

    HttpResponseMessage httpResponseMessage;
    try
    {
        httpResponseMessage = httpClient.GetAsync(requestUri).Result;
    }
    catch (Exception ex)
    {
        return null;
    }

    if (httpResponseMessage.StatusCode != HttpStatusCode.OK)
    {
        return null;
    }

    var response = httpResponseMessage.Content.ReadAsStringAsync().Result;
    var googleApiTokenInfo = JsonConvert.DeserializeObject<GoogleApiTokenInfo>(response);

    if (!SupportedClientsIds.Contains(googleApiTokenInfo.aud))
    {
        Log.WarnFormat("Google API Token Info aud field ({0}) not containing the required client id", googleApiTokenInfo.aud);
        return null;
    }

    return new ProviderUserDetails
    {
        Email = googleApiTokenInfo.email,
        FirstName = googleApiTokenInfo.given_name,
        LastName = googleApiTokenInfo.family_name,
        Locale = googleApiTokenInfo.locale,
        Name = googleApiTokenInfo.name,
        ProviderUserId = googleApiTokenInfo.sub
    };
}

GoogleApiTokenInfo类:

public class GoogleApiTokenInfo
{
/// <summary>
/// The Issuer Identifier for the Issuer of the response. Always https://accounts.google.com or accounts.google.com for Google ID tokens.
/// </summary>
public string iss { get; set; }

/// <summary>
/// Access token hash. Provides validation that the access token is tied to the identity token. If the ID token is issued with an access token in the server flow, this is always
/// included. This can be used as an alternate mechanism to protect against cross-site request forgery attacks, but if you follow Step 1 and Step 3 it is not necessary to verify the 
/// access token.
/// </summary>
public string at_hash { get; set; }

/// <summary>
/// Identifies the audience that this ID token is intended for. It must be one of the OAuth 2.0 client IDs of your application.
/// </summary>
public string aud { get; set; }

/// <summary>
/// An identifier for the user, unique among all Google accounts and never reused. A Google account can have multiple emails at different points in time, but the sub value is never
/// changed. Use sub within your application as the unique-identifier key for the user.
/// </summary>
public string sub { get; set; }

/// <summary>
/// True if the user's e-mail address has been verified; otherwise false.
/// </summary>
public string email_verified { get; set; }

/// <summary>
/// The client_id of the authorized presenter. This claim is only needed when the party requesting the ID token is not the same as the audience of the ID token. This may be the
/// case at Google for hybrid apps where a web application and Android app have a different client_id but share the same project.
/// </summary>
public string azp { get; set; }

/// <summary>
/// The user's email address. This may not be unique and is not suitable for use as a primary key. Provided only if your scope included the string "email".
/// </summary>
public string email { get; set; }

/// <summary>
/// The time the ID token was issued, represented in Unix time (integer seconds).
/// </summary>
public string iat { get; set; }

/// <summary>
/// The time the ID token expires, represented in Unix time (integer seconds).
/// </summary>
public string exp { get; set; }

/// <summary>
/// The user's full name, in a displayable form. Might be provided when:
/// The request scope included the string "profile"
/// The ID token is returned from a token refresh
/// When name claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.
/// </summary>
public string name { get; set; }

/// <summary>
/// The URL of the user's profile picture. Might be provided when:
/// The request scope included the string "profile"
/// The ID token is returned from a token refresh
/// When picture claims are present, you can use them to update your app's user records. Note that this claim is never guaranteed to be present.
/// </summary>
public string picture { get; set; }

public string given_name { get; set; }

public string family_name { get; set; }

public string locale { get; set; }

public string alg { get; set; }

public string kid { get; set; }
}

Answer 2

根据这个github 问题,您现在可以使用GoogleJsonWebSignature.ValidateAsync方法来验证Google签名的JWT.只需将idToken字符串传递给方法即可.

var validPayload = await GoogleJsonWebSignature.ValidateAsync(idToken);
Assert.IsNotNull(validPayload);

如果它不是有效的,它将返回null.

请注意,要使用此方法,您需要先手动安装Google.Apis.Auth nuget.

Answer 3

Google 在openId connect的文档中声明

出于调试目的，您可以使用 Google 的 tokeninfo 端点。假设您的 ID 令牌的值为 XYZ123。

您不应该使用该端点来验证您的 JWT。

验证 ID 令牌需要几个步骤：

1. 验证 ID 令牌是否由颁发者正确签名。Google 颁发的令牌使用在发现文档的 jwks_uri 字段中指定的 URI 中找到的证书之一进行签名。
2. 验证 ID 令牌中 iss 的值是否等于https://accounts.google.com或 accounts.google.com。
3. 验证 ID 令牌中的 aud 值是否等于您应用的客户端 ID。
4. 验证 ID 令牌的到期时间 (exp) 是否尚未过去。
5. 如果您在请求中传递了 hd 参数，请验证 ID 令牌具有与您的 G Suite 托管域匹配的 hd 声明。

还有关于如何验证他们的官方样片的项目在这里。不幸的是，我们还没有将它添加到 Google .Net 客户端库中。它已被记录为问题