search

freckle / yesod-auth-oauth2

OAuth2 authentication for yesod
MIT License
71 stars 53 forks source link

Google+ Sign-in deprecation #121

Closed ivanperez-keera closed 5 years ago

ivanperez-keera commented 5 years ago

I just got an email saying that a yesod web app that we have running is using Google+ sign in for authentication.

I've looked at this code and I believe this does not use Google+ but simply Google sign on, but I'm not an expert and I'd rather check ahead of time than wait to find out all users are locked out.

Is this going to be affected by the deprecation of Google+'s API [1]?

[1] https://developers.google.com/+/api-shutdown

pbrisbin commented 5 years ago

Thanks for bringing this up.

Google is notoriously vague with this stuff, so I have no guarantees about what will happen to my or your apps running this plugin when these dates come and go, unfortunately.

That said, it also seems to me that we are not using Google+ APIs here. It's very clear the URLs we're using in the plugin:

And these are (modulo versions) the same endpoints documented in the non-deprecated OAuth2 path for Google Sign-on, which are:

We then use this end-point to get the current user's info:

And that should also be a valid API endpoint and un-related to Google+.

Is it possible to follow up through the email you received and see exactly what endpoints are being used by your app?

jferris commented 5 years ago

Is it possible you're requesting some scopes related to Google+?

pbrisbin commented 5 years ago

The default scopes are openid and email. AFAICT, these both still supported. @ivanperez-keera are you using the Scoped function with your own scopes?

ivanperez-keera commented 5 years ago

The email says we are sending requests to 'plus.people.get'.

The code for this yesod page has not changed much in years. The only use of Google's API is for authentication. Did this package ever use the old API? Maybe our yesod app is just using an old version.

pbrisbin commented 5 years ago

I can dig into git history when I'm at a computer next, but I think yes, this package used to use that endpoint to retrieve profile details. If you can tell me what version you're using, we could confirm if that's the case.

ivanperez-keera commented 5 years ago

Thanks. Currently, it is (still) compiling using yesod-auth-1.4.5 and using Yesod.Auth.GoogleEmail2.

pbrisbin commented 5 years ago

Oh yeah, that's not even this library. Migrating to us might be a good fix!