googlesamples / google-services

A collection of quickstart samples demonstrating the Google APIs for Android and iOS
https://developers.google.com
Apache License 2.0
3.07k stars 2.53k forks source link

Bug: login->revoke permissions->login ->returns unusable token #520

Open AndroidDeveloperLB opened 2 years ago

AndroidDeveloperLB commented 2 years ago

Step 3: Describe the problem:

Basically I wrote about this here: https://stackoverflow.com/questions/70377774/how-to-avoid-getting-a-bad-token-after-google-login-dialog

After I've logged-in and granted permissions, and then revoked them, next login will return me the old token that can't be used anymore, so currently the workaround I've found is to logout again and ask to login yet again, showing 3 dialogs instead of just 2:

  1. Login
  2. Grant permissions
  3. Login again, as the previous one gave a bad token.

Steps to reproduce:

  1. Login to Google and grant permissions. Check the token and see that it can be used.
  2. Uninstall the app or clear-data
  3. Revoke all permissions to the app using this website: https://myaccount.google.com/permissions?pli=1 . Maybe possible via the app inside of Android too.
  4. Use the app to login again. Check the token and see that it can be used.

Observed Results:

The new token is actually the exact same one (probably cached) as before, yet you can't use it even though the user has logged in using the dialog just now.

Expected Results:

As it's a new login dialog, the token that we get should be usable, whether it's a new one or cached.

Relevant Code:

To get the Intent to login, this is the basic code:

val options =
    GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
        .requestServerAuthCode(googleClientId)
        .requestEmail()
        .build()
val signInClient = GoogleSignIn.getClient(context, options)
return signInClient.signInIntent
AndroidDeveloperLB commented 2 years ago

I don't understand the question