dart - "error_description": "Invalid Value" for token google sign in every time using flutter

Question

我是 flutter 的新手，试图从我的后端服务器从 google 访问 auth token ，但每次 token 都无效。

我正在使用 FirebaseUser user await user.getIdToken() 我给了我一个 token ，但是当我尝试使用我的后端服务器以及 https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=mytoken 验证该 token 时和 https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=mytoken 这个链接它给我 "error_description": "Invalid Value"。

我不确定await user.getIdToken() 这个方法是否适合获取 token 。其他人认为一切正常，我正在获取除正确 token 之外的所有用户信息。如果有任何其他方式，请告诉我。

下面是我的代码:

class LoginScreen extends StatefulWidget {
  @override
  _LoginScreenState createState() => new _LoginScreenState(); 
}

class _LoginScreenState extends State<LoginScreen> {
  final FirebaseAuth auth = FirebaseAuth.instance;
  final GoogleSignIn googleSignIn = new GoogleSignIn();
  Future<http.Response> socailLogin(String authToken) async {
    var url = "http://api.ourdomain.com/user/social/login/google";
    final response = await http.post(url,
    body: json.encode({"auth_token": authToken}),
    headers: {HttpHeaders.CONTENT_TYPE: "application/json"});
    return response;
  }

  Future<FirebaseUser> googleSignin() async {
  final GoogleSignInAccount googleSignInAccount = await 
  googleSignIn.signIn();

  final GoogleSignInAuthentication googleSignInAuthentication =
    await googleSignInAccount.authentication;

  final FirebaseUser firebaseUser = await auth.signInWithGoogle(
    accessToken: googleSignInAuthentication.accessToken,
    idToken: googleSignInAuthentication.idToken);
   return firebaseUser;
 }

@override
Widget build(BuildContext context) {
final logo = Hero(
  tag: 'hero',
  child: CircleAvatar(
    backgroundColor: Colors.transparent,
    radius: 48.0,
    child: Image.asset('assets/logo.png'),
  ),
);


final googleloginButton = Padding(
  padding: EdgeInsets.symmetric(vertical: 5.0),
  child: Material(
    borderRadius: BorderRadius.circular(30.0),
    //  shadowColor: Colors.lightBlueAccent.shade100,
    // elevation: 5.0,
    child: MaterialButton(
      minWidth: 200.0,
      height: 42.0,
      onPressed: () async {
        FirebaseUser user = await googleSignin();
         String idToken = await user.getIdToken();
        if (idToken != null) {

          final http.Response response = await socailLogin(idToken);
          if (response.statusCode == 200) {
            var authToken = json.decode(response.body)['token'];
            if (authToken != null) {
              storedToken(authToken);
            }
          } else {
            print("Response status: " + response.statusCode.toString());
            print("Response body: " + response.body);
            print("errror while request");
          }
        } else {
          print("in else part not get token id from google");
        }
        Navigator.push(
          context,
          MaterialPageRoute(
            builder: (context) => HomeScreen(),
          ),
        );
      },
      color: Colors.red,
      child: Row(
        mainAxisAlignment: MainAxisAlignment.center,
        mainAxisSize: MainAxisSize.min,
        children: <Widget>[
          Icon(
            Icons.bug_report,
            color: Colors.white,
          ),
          Text('Connect with Google',
              style: TextStyle(color: Colors.white)),
        ],
      ),
    ),
  ),
);

 return Scaffold(
   backgroundColor: Colors.white,
   appBar: new AppBar(
     centerTitle: true,
     title: new Text("Login"),
   ),
   body: Center(
    child: ListView(
      shrinkWrap: true,
      padding: EdgeInsets.only(left: 24.0, right: 24.0),
      children: <Widget>[
        // logo,
        googleloginButton,
        facebookloginButton,
      ],
     ),
   ),
  );
 }
}

请帮助我。

Answer 1

对于后端服务器端验证，您必须使用可验证的 ID token 在服务器端安全地获取已登录用户的用户 ID。引用。 : https://developers.google.com/identity/sign-in/web/backend-auth

貌似目前的flutter google sign in plugin不支持获取后端服务器端OAuth验证的AuthCode。引用。 : https://github.com/flutter/flutter/issues/16613

我认为 firebaseUser.getIdToken() 不能用于 Google API。

对于 https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=mytoken，您可能需要传递 googleSignInAuthentication.idToken

对于 https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=mytoken，您可能需要传递 googleSignInAuthentication.accessToken

获取用户 ID 等用户信息并将其传递到后端服务器端容易受到黑客攻击。您应该通过 Google API 客户端库在后端服务器端验证 idToken。