3

This is my understanding about auth flow for a web application;

enter image description here

This is recommended for mobile application, as per RFC 8252

enter image description here

When I go to Google developers console > Create Credentials > OAuth Client id > Android [Application type], it asks me for: name, SHA1 fingerprint, and package name.

I'm assuming that the redirect URI is not required, and my app will get the control or rather auth code when a user authorizes my application as I'm setting the package name when I create credential. (As given in this answer). Please correct me if my understanding is wrong.

At this point, I need to send the auth_code to the server for validation which requires client id, and secret. But I'm not provided with any client secret at the time of creating credentials.

So how exactly this whole thing should work?

UPDATE

I tried to generate configuration from their tutorial. It generated 2 credentials: one for web application, another for Android. It has also generated a credentials.json which contains an entry for web-client. Now if I understnad correctly, this code will go in android app to get auth code.

GoogleSignInOptions gso = new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
        .requestEmail()
        .requestServerAuthCode("client id issued for web application")'
        .build()

However, if my above finding is correct then it raises more questions to validate my finding.

  1. When will I pass client id generated for Android?
  2. What will be the redirect URL in this case? ( I don't think we need to set it)
  3. Will I've to use all the client IDs at server side to validate the auth_code?
Amit Kumar Gupta
  • 6,271
  • 11
  • 54
  • 77
  • I've got all the answer excluding one that if I need to implement redirect URL as server side. – Amit Kumar Gupta Nov 24 '18 at 02:30
  • Amit, did you ever find out why we don't need redirect_uri? How does Google Sign in work without it? – Philip Apr 02 '20 at 04:27
  • redirect_uri is needed in 2 sense. 1) it gives extra security if it is set in your auth account. 2) It redirects your app to given URL. – Amit Kumar Gupta Apr 02 '20 at 04:59
  • Thanks for your response, but actually I was wondering what is the redirect uri in the Android Google Sign in library (if you don't set it explicitly)? If you know, feel free to answer my question here: https://stackoverflow.com/questions/60984286/how-does-google-sign-in-for-android-work-without-a-redirect-uri?noredirect=1#comment107892720_60984286 – Philip Apr 02 '20 at 10:43
  • 1
    Actually nevermind, I found the answer in a youtube video. I posted the answer here: https://stackoverflow.com/questions/60984286/how-does-google-sign-in-for-android-work-without-a-redirect-uri/60991729#60991729 – Philip Apr 02 '20 at 12:36

0 Answers0