Open Vektorised opened 10 months ago
Notes:
As per Google's documentation, the unique intentifier (sub
field of returned token) should be the only identification for the app. The email should not be used as a user could change their email on Google. This identifier is unique for each Google account and never changes. However, the current sign in procedure uses an axios POST with an email and password to identify the user and start a user session.
sub
field) for the user to pull from database. Current State:
Next Steps:
Wrap-Up:
Testing Overview:
Initial Setup and Functionality Testing: We initiated the process by linking our application with Google Identity using a client ID and incorporating a "Sign In With Google" button following Google's guidelines. Our team modified the existing "handleLogin" function and integrated a callback to manage log-ins via Google. We conducted several tests to ensure the basic functionality worked correctly. Token Integrity and Security Testing: We implemented a mechanism to verify the integrity of the Google token response, a critical step to ensure the security and authenticity of the login process. This was crucial for maintaining the integrity and reliability of the user authentication process. Account Retrieval Methodology: Initially, our implementation used a returned email and a hardcoded password for demonstration purposes. Recognizing the need for a more secure approach, we decided to transition to using the unique Google ID (sub field) for user identification, in line with Google's recommendations. Comprehensive Sign-In Testing: We rigorously retested the sign-in features using various Google accounts, including those with differing access permissions in the Google Cloud Console. This step was vital to ascertain the effectiveness of our implementation under various scenarios and user types. OAuth Integration and UID Management: In collaboration, we implemented a custom OAuth API to verify Google tokens and introduced a field within the user account model to accommodate a Google UID. This allowed us to test and confirm that users were able to sign in through Google and that our server efficiently retrieved accounts based on the Google UID.
Point Value: 3
Acceptance Criteria:
Tasks: