google / google-api-javascript-client

Google APIs Client Library for browser JavaScript, aka gapi.
Apache License 2.0
3.22k stars 1.06k forks source link

How to get User Info (Email ID) while using the Authorization Code Flow #866

Open SaravgiYash opened 1 year ago

SaravgiYash commented 1 year ago

Important gapi.auth2 notice: gapi.auth2 has been deprecated and replaced with Google Identity Services. Please see https://developers.google.com/identity/sign-in/web/deprecation-and-sunset for more information. If you have questions related to authentication/authorization please look at the associated documentation or post questions on Stack Overflow with the google-oauth tag.

Summary I have migrated to the GIS but unable to understand how to get the User Profile Info without using the Auth Code. So I use the Authorization Code Flow which returns the Auth Code, which I send back to the backend. But I also require the user email id to map the same. But I am unable to find any documentation which solves this problem.

To get user profile information one needs to use the Auth Code and generate the access_token and refresh_token and use the same to call People's API. But then the Auth Code cannot be used by the backend.

Currently I am using an input field to get the user email id but it's causes issues due to typos.

function initClient() { client = google.accounts.oauth2.initCodeClient({ client_id: CLIENT_ID, scope: SCOPES, ux_mode: 'popup', callback: async (response) => { auth_code = response.code; // Logic to send the Auth Code to the backend with user email ID } }); }

hermz365 commented 1 year ago

To obtain user profile information, you should use Sign in with Google library to obtain a JWT ID Token. You can use the Sign in with Google button and/or One Tap to authenticate your users and obtain the JWT ID Token.

masa8 commented 1 year ago

I want to know this too. I added an API on the backend for the client to get the information needed for now. but I don't know if this is common and if there are any security risks. This question is more about Authorization code flow than about this library though... 😅