search

aubm / golang-google-sign-in

3 stars 2 forks source link

Are you assuming Google's idToken will be signed with a specific algorithm? #1

Closed mvpmvh closed 7 years ago

mvpmvh commented 7 years ago

https://github.com/aubm/golang-google-sign-in/blob/master/app.go#L29

here you hard-code a signing algorithm. How do you know that is the correct algorithm?

mvpmvh commented 7 years ago

I'm guessing you just assumed Google will always use RSA256 based upon https://www.googleapis.com/oauth2/v3/certs