search

googleapis / google-api-nodejs-client

Google's officially supported Node.js client library for accessing Google APIs. Support for authorization and authentication with OAuth 2.0, API Keys and JWT (Service Tokens) is included.
https://googleapis.dev/nodejs/googleapis/latest/
Apache License 2.0
11.36k stars 1.92k forks source link

google-api-nodejs-client JWT Verification #1624

Closed ryancampag closed 3 years ago

ryancampag commented 5 years ago

Hangouts chat has recently switched over to sending JWT tokens for authorization in HTTP requests that are dispatch to bots, and are encouraging their users to migrate to using these instead of the static tokens they had before.

There are a couple of samples for the Java and Python clients located in the dev docs here: https://developers.google.com/hangouts/chat/how-tos/bots-develop#verifying_bot_authenticity

I can't figure out how to do what we're doing in Node.js, without manually querying for public keys, handling the tokens key-id, etc.

Specifically, the Java and Python libraries both support a URL input for the issuer. This is especially useful in our case for 2 reasons: 1) We aren't verifying against Google's token, but a service account, and 2) The service account has multiple keys, dependent on the key id (kid) in the token headers

So then my questions are: 1) Is this already supported in the node.js client, and I'm just missing it? 2) If not, are there plans for feature parity with the Java/Python OAuth2 libraries, or should we try to construct a sample that manually fetches the keys, compares the key id to get the right key, etc.

Thanks for your thoughts!

martinlarosa commented 5 years ago

I would like to also know the answer to this, I'm stuck trying to integrate a botkit bot with hangouts because of this. Any luck @ryancampag ?

ryancampag commented 5 years ago

I haven't personally written a successful solution to this. However, you could just query the public key and handle the kid field manually. It doesn't seem like there's support for this in the nodejs client at this point.

martinlarosa commented 5 years ago

Is there a chance that you could point me to an example of how to do this? Or a lead on what to investigate. I'm not very familiar with this.

fhinkel commented 3 years ago

Greetings, we're closing this due to inactivity. Please let us know if the issue needs to be reopened.

shlasouski commented 3 years ago

Please read Verifying Google Chat request in NodeJS post. I would greatly appreciate any feedback!