django - 403 错误，因为 `id_token` 在 Django + python-social-app 中被用作 `access_token`

Question

我很迷惑。我正在使用 python-social-auth 的 Django 配置(特别是 social-auth-app-django v1.2.0)来使 Google+ 后端身份验证正常工作。

我收到此错误:

requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://www.googleapis.com/plus/v1/people/me?access_token=XYZ123&alt=json

社会身份验证似乎正在传递参数 access_token但我不知道为什么因为
docs说要传递给后端 id_token .
我已经确认我得到的是一个有效的 id_token使用此链接:
https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123

此外，我使用此链接验证它不是有效的 access_token:
https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=XYZ123

我的意思是，我正在做 python-social-apps docs和谷歌的 docs是叫我做，那就是通过 id_token到后端。这是我的js代码:

<script src="https://apis.google.com/js/api:client.js"></script>
<script>
    var googleUser = {};
    var startApp = function() {
        gapi.load('auth2', function() {
            // Retrieve the singleton for the GoogleAuth library and set up the client.
            auth2 = gapi.auth2.init({
                client_id: '{{ google_plus_id }}',
                cookiepolicy: 'single_host_origin',
                // Request scopes in addition to 'profile' and 'email'
                scope: '{{ google_plus_scope }}',
            });
            attachSignin(document.getElementById('google-plus-button'));
        });
    };

    function attachSignin(element) {
        console.log(element.id);
        auth2.attachClickHandler(element, {},
            function(googleUser) {

                var authResponse = googleUser.getAuthResponse();
                var $form;
                var $input;

                $form = $("<form>");
                $form.attr("action", "/complete/google-plus/");
                $form.attr("method", "post");
                $input = $("<input>");
                $input.attr("name", "id_token");
                $input.attr("value", authResponse.id_token);
                console.log("ID Token: " + authResponse.id_token);
                $form.append($input);
                $(document.body).append($form);
                $form.submit();

            },
            function(error) {
                alert(JSON.stringify(error, undefined, 2));
            });
    }
</script>

<script>
    startApp();
</script>

这是我的设置:

AUTHENTICATION_BACKENDS = (
   ...
   'social_core.backends.google.GooglePlusAuth',
   ..
)
SOCIAL_AUTH_GOOGLE_PLUS_KEY = 'blahblah.apps.googleusercontent.com'
SOCIAL_AUTH_GOOGLE_PLUS_SECRET = 'shhhsecret'

SOCIAL_AUTH_GOOGLE_OAUTH2_SCOPE = []

SOCIAL_AUTH_GOOGLE_PLUS_SCOPE = [
    "email",
    "profile"
]

SOCIAL_AUTH_PIPELINE = (
    'social_core.pipeline.social_auth.social_details',
    'social_core.pipeline.social_auth.social_uid',
    'social_core.pipeline.social_auth.auth_allowed',
    'social_core.pipeline.social_auth.social_user',
    'social_core.pipeline.user.get_username',
    'social_core.pipeline.user.create_user',
    # 'apps.django_social_app.pipeline.save_profile',  
    'social_core.pipeline.social_auth.associate_user',
    'social_core.pipeline.social_auth.load_extra_data',
    'social_core.pipeline.user.user_details',
    'social.pipeline.debug.debug', # uncomment to print debug
)

这里是完整的跟踪:

Traceback (most recent call last):
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django/contrib/staticfiles/handlers.py", line 63, in __call__
    return self.application(environ, start_response)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django/core/handlers/wsgi.py", line 189, in __call__
    response = self.get_response(request)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django/core/handlers/base.py", line 218, in get_response
    response = self.handle_uncaught_exception(request, resolver, sys.exc_info())
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django/core/handlers/base.py", line 261, in handle_uncaught_exception
    return debug.technical_500_response(request, *exc_info)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django_extensions/management/technical_response.py", line 6, in null_technical_500_response
    six.reraise(exc_type, exc_value, tb)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/six.py", line 686, in reraise
    raise value
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django/core/handlers/base.py", line 132, in get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django/views/decorators/cache.py", line 57, in _wrapped_view_func
    response = view_func(request, *args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/django/views/decorators/csrf.py", line 58, in wrapped_view
    return view_func(*args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_django/utils.py", line 50, in wrapper
    return func(request, backend, *args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_django/views.py", line 32, in complete
    redirect_name=REDIRECT_FIELD_NAME, *args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/actions.py", line 41, in do_complete
    user = backend.complete(user=user, *args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/backends/base.py", line 39, in complete
    return self.auth_complete(*args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/utils.py", line 252, in wrapper
    return func(*args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/backends/google.py", line 144, in auth_complete
    return self.do_auth(token, response=response, *args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/utils.py", line 252, in wrapper
    return func(*args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/backends/oauth.py", line 403, in do_auth
    data = self.user_data(access_token, *args, **kwargs)
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/backends/google.py", line 59, in user_data
    'alt': 'json'
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/backends/base.py", line 227, in get_json
    return self.request(url, *args, **kwargs).json()
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/social_core/backends/base.py", line 223, in request
    response.raise_for_status()
  File "/Users/paul/.pyenv/versions/dj-viewflow/lib/python3.4/site-packages/requests/models.py", line 929, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://www.googleapis.com/plus/v1/people/me?alt=json&access_token=XYZ123

我究竟做错了什么？帮助。 :)

更新 :这似乎是 social-core 中的一个悬而未决的问题 repo

https://github.com/python-social-auth/social-core/issues/61

这并没有真正解决我的问题，因为与上面那个链接中的解决方案不同，我需要用户数据，因为我需要将其记录在我的数据库中。

更新 2:这可能是罪魁祸首，因为它通过了 id_token进 access_token范围:

https://github.com/python-social-auth/social-core/commit/3b496bacef62d12dc1439431b64ed24e252f7a9a

Answer 1

所以这很晚了，但我想通了。迟到总比不到好，对吧？

所以基本上我最终使用了 Google People API 而不是 Google+，这是给我带来问题的原因。

我不得不去console.developers.google.com -> “我的项目名称” -> “启用 API” -> “人员 API”

创建人员 api 后，找到“凭据”部分
然后将“授权重定向 URI”设置为:
http://localhost:8000/complete/google-oauth2/
产品:https://example.com/complete/google-oauth2/
设置.py

AUTHENTICATION_BACKENDS = (
     # ...
    'social_core.backends.google.GoogleOAuth2',
     # ...
    'django.contrib.auth.backends.ModelBackend',
)

SOCIAL_AUTH_GOOGLE_OAUTH2_KEY = 'thekey' # from People API
SOCIAL_AUTH_GOOGLE_OAUTH2_SECRET = 'mysecretkey' # from People API

SOCIAL_AUTH_PIPELINE = (
    'social_core.pipeline.social_auth.social_details',
    'social_core.pipeline.social_auth.social_uid',
    'social_core.pipeline.social_auth.auth_allowed',
    'social_core.pipeline.social_auth.social_user',
    'social_core.pipeline.user.get_username',
    'social_core.pipeline.user.create_user',
    'social_core.pipeline.social_auth.associate_user',
    'social_core.pipeline.social_auth.load_extra_data',
    'social_core.pipeline.user.user_details',
    #'social_core.pipeline.debug.debug', # uncomment to print debug
)