passport-google-oauth20

Passport strategy for authenticating with Google using the OAuth 2.0 API.

This module lets you authenticate using Google in your Node.js applications. By plugging into Passport, Google authentication can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

1Password, the only password manager you should trust. Industry-leading security and award winning design.

Status:

Install

$ npm install passport-google-oauth20

Usage

Create an Application

Before using passport-google-oauth20, you must register an application with Google. If you have not already done so, a new project can be created in the Google Developers Console. Your application will be issued a client ID and client secret, which need to be provided to the strategy. You will also need to configure a redirect URI which matches the route in your application.

Configure Strategy

The Google authentication strategy authenticates users using a Google account and OAuth 2.0 tokens. The client ID and secret obtained when creating an application are supplied as options when creating the strategy. The strategy also requires a verify callback, which receives the access token and optional refresh token, as well as profile which contains the authenticated user's Google profile. The verify callback must call cb providing a user to complete authentication.

var GoogleStrategy = require('passport-google-oauth20').Strategy;

passport.use(new GoogleStrategy({
    clientID: GOOGLE_CLIENT_ID,
    clientSecret: GOOGLE_CLIENT_SECRET,
    callbackURL: "http://www.example.com/auth/google/callback"
  },
  function(accessToken, refreshToken, profile, cb) {
    User.findOrCreate({ googleId: profile.id }, function (err, user) {
      return cb(err, user);
    });
  }
));

Authenticate Requests

Use passport.authenticate(), specifying the 'google' strategy, to authenticate requests.

For example, as route middleware in an Express application:

app.get('/auth/google',
  passport.authenticate('google', { scope: ['profile'] }));

app.get('/auth/google/callback', 
  passport.authenticate('google', { failureRedirect: '/login' }),
  function(req, res) {
    // Successful authentication, redirect home.
    res.redirect('/');
  });

Google Plus API Deprecation

The default for passport-google-oauth2 is to use the Google+ People API to get the profile information for the user signing in. With this API being removed in early 2019 you should look towards using the OAuth 2 User Info endpoint instead. You can switch to this endpoint using this configuration option.

new GoogleStrategy({
  clientID: GOOGLE_CLIENT_ID,
  clientSecret: GOOGLE_CLIENT_SECRET,
  callbackURL: "http://www.example.com/auth/google/callback",
  // This option tells the strategy to use the userinfo endpoint instead
  userProfileURL: "https://www.googleapis.com/oauth2/v3/userinfo",
}

The structure of the profile object will be the same but you may get less profile information than you did before.

Examples

Developers using the popular Express web framework can refer to an example as a starting point for their own web applications. The example shows how to authenticate users using Facebook. However, because both Facebook and Google use OAuth 2.0, the code is similar. Simply replace references to Facebook with corresponding references to Google.

Sponsorship

Passport is open source software. Ongoing development is made possible by generous contributions from individuals and corporations. To learn more about how you can help keep this project financially sustainable, please visit Jared Hanson's page on Patreon.

License

The MIT License

RipSecrets

We implement pipeline secret scanning on all pull request events to prevent credentials from being merged. If the pipeline scanner detects a secret in your changed files it will gate the pull request and you will need to purge the found credential from your code and re-open the PR. To prevent getting gated by this tool and as best practice you should install the secret scanner locally in a pre-commit hook to prevent the secret from ever being committed to the repo in the first place. You can find documentation on how to set it up locally here
Ripsecrets has ways to bypass secret scanning although we should not be ignoring secrets that turn up in the scans. If something is out of your control and blocking the pipeline you can bypass it in one of the following ways

Adding "# pragma: allowlist secret" to the end of the line with the secret.
Adding the specific secret underneath the "[secrets]" block in .secretsignore
Adding the filepath to ignore the whole file aboove the "[secrets]" block in .secretsignore

bombbomb/passport-google-oauth2