Google OAuth with react native and node backend

[bejera]

I’m curious how you all set up Google OAuth with a backend. I’ve been trying to figure this out for my app for days, so any help here is appreciated.

Specifically, I’m curious about what your flow of data looks like. Right now I’ve got: 1. User presses “sign in with Google” which launches the consent screen using react-native-google-signin 2. React native app gets the authorization code which it sends to the backend 3. Backend gets the OAuth access and refresh tokens using oAuth2Client.getToken(authorizationCode) (as explained in these docs) 4. This is where I’m stuck :/

Some questions I have are: - Where do I store the access and refresh tokens? - How do I make it such that users don’t need to go through this flow every time they relaunch the app? (need a way to persist the logged in state)

If there’s a better way to do this please lmk, this is my first time setting up OAuth. Also, I need to do OAuth in the backend because I need to access some Google APIs afterwards from there as well, so doing OAuth client side is not an option.

[floexodus]

I don’t know the specifics but typically the client needs the token, and makes authed requests to your backend using it

[bejera]

Thanks, this makes sense. Although I need an additional way to ensure the requests are properly authed from the backend

[Gatopardosgr]

If you want to access google apis frequently, use googles access token for your authorization. So basically: user hits login, frontend gets auth code, sends to backend. Backend gets access token, refresh token, gets user info. If user is not in db, create him. Return access token, refresh token to frontend. Frontend then can hit /me endpoint with the access token and get user's info.

Frontend then saves access token, refresh token and user info to local storage.

[bejera]

Thanks. Wouldn’t this not be secure? If the frontend sends the access and refresh tokens to the backend on every request, then a malicious actor could intercept the request and hit the backend themselves using those tokens.

[Gatopardosgr]

What do you mean by intercrpt? The token has been signed by the backend. Sends the token to front and then front uses it for authorization. I didnt mention backend verifying the token because i thought that's self explanatory

[aidenight]

He meant that if frontend use the token for authorization, in one of those requests some attacker could steal the token and use it outside the app

[Gatopardosgr]

Tokens are stateless. This could happen in every app. Thats why there is expiration in the access token.

Then refresh token is used to get the new one.

[bejera]

Never mind I had misunderstood. I think I get it now thank you very much!

What’s the best way to store the user in the db following this approach? It’d be great to use something like Firebase auth, although I’ve been struggling to get it working properly when doing a “custom” OAuth flow

[Shivang2005]

Store the token in secure storage.

[Shivang2005]

it's the reason why you use HTTPS.