OAuth2 and OpenID Connect

The problem: your own authentication is risky

• You must hash them correctly (bcrypt, not SHA-256).
• You must handle password resets securely.
• You must prevent brute-force attacks.
• If you're breached, millions of passwords are exposed.

OAuth2 at a glance

1. Alice clicks "Sign in with Google" on your website.
2. You redirect Alice to Google: https://accounts.google.com/o/oauth2/v2/auth?client_id=xxx&redirect_uri=https://myapp.com/callback&scope=openid%20email&response_type=code
3. Google shows a login form: Alice enters her email/password.
4. Alice grants permission: "Let myapp.com access your email and profile."
5. Google redirects back to you: https://myapp.com/callback?code=abc123&state=xyz789
6. You exchange the code for a token: backend-to-backend call to Google's token endpoint:

   POST https://oauth2.googleapis.com/token
   client_id=xxx
   client_secret=yyy  (your app's secret, kept on the backend)
   code=abc123
   redirect_uri=https://myapp.com/callback
   

   Copy
7. Google sends back an access token: {"access_token": "ya29...", "id_token": "eyJhbGc...", "expires_in": 3600}
8. You verify the token: check the signature, extract alice@example.com, and create an account or session for alice.
9. Alice is logged in on your app.

• Alice's password never touches your servers.
• Google handles password security.
• You only deal with tokens.

OAuth2 terms

• Authorization Server (Google): the trusted provider.
• Resource Owner (Alice): the user.
• Client (your website): the app asking for access.
• Authorization Code (abc123): a short-lived, single-use code proving Alice approved your app.
• Access Token (ya29...): a token proving your app can access Alice's data on Google's servers.
• Redirect URI (https://myapp.com/callback): where Google sends Alice back after she approves.
• Client ID and Client Secret: your app's credentials with Google.

OpenID Connect (OIDC): OAuth2 + authentication

{
  "iss": "https://accounts.google.com",
  "sub": "110169547959700850118",  // Google's unique ID for Alice
  "email": "alice@example.com",
  "email_verified": true,
  "aud": "YOUR_CLIENT_ID",
  "iat": 1692921600,
  "exp": 1692925200
}

OAuth2 code vs implicit flow

1. Frontend redirects to Google.
2. Google sends a code back to the frontend.
3. Frontend sends the code to your backend.
4. Backend exchanges code for a token (backend-to-backend call).

1. Frontend redirects to Google.
2. Google sends the access token directly to the frontend.

Setting up OAuth2: Google example

1. Create a Google Cloud project: go to console.cloud.google.com.
2. Create OAuth2 credentials:
   • Authorized JavaScript origins: https://myapp.com
   • Authorized redirect URIs: https://myapp.com/callback
   • Copy the Client ID and Client Secret.
3. Frontend: add a "Sign in with Google" button:

   <button onclick="loginWithGoogle()">Sign in with Google</button>
   <script src="https://accounts.google.com/gsi/client" async defer></script>
   <script>
     function loginWithGoogle() {
       google.accounts.id.initialize({ client_id: 'xxx' });
       google.accounts.id.renderButton(
         document.getElementById('buttonDiv'),
         { theme: 'outline', size: 'large' }
       );
     }
   </script>

   Copy

4. Backend: handle the callback:

   from google.auth.transport import requests
   from google.oauth2 import id_token
    
   @app.post('/callback')
   def handle_callback():
       token = request.json.get('credential')  # JWT from Google
       try:
           id_info = id_token.verify_oauth2_token(token, requests.Request(), CLIENT_ID)
           email = id_info.get('email')
           # Create or find user
           user = db.find_or_create_user(email=email)
           issue_session_token(user)
       except ValueError:
           return 401  # invalid token

   Copy

Multi-tenant OAuth2

• Alice (alice@company-a.com) can only log in with her company Google Workspace account.
• Bob (bob@company-b.com) can only log in with his company's Google Workspace account.

https://accounts.google.com/o/oauth2/v2/auth?...&hd=company-a.com

Common mistakes

# RISKY
request.session['access_token'] = access_token_from_google

# WRONG — trusts the token without verification
payload = jwt.decode(token, options={"verify_signature": False})
 
# CORRECT — verifies the signature against Google's public keys
id_info = id_token.verify_oauth2_token(token, requests.Request(), CLIENT_ID)

# WRONG — ignores state
@app.get('/callback')
def callback():
    code = request.args.get('code')
    # exchange code for token

# Frontend: store a random state before redirecting to Google
state = generate_random_token()
request.session['oauth_state'] = state
# Redirect: ...&state=<state>
 
# Backend: verify state matches
@app.get('/callback')
def callback():
    state = request.args.get('state')
    if state != request.session.get('oauth_state'):
        return 403  # CSRF attack
    code = request.args.get('code')
    # exchange code for token

# RISKY
email = request.json.get('email')  # from frontend
user = db.find_or_create_user(email=email)

Further reading

• OAuth2 spec
• OpenID Connect spec
• Auth0 — OAuth2 explained
• Google OAuth2 documentation