Google backend authenticate failure, base64 decoding fails at GoogleIdTokenVerifier.verify

[yerzhik]

Environment details

1. OS type and version: Windows 7
2. Java version: 8
3. google-api-client version(s): 1.30.4

Steps to reproduce

1. Follow steps in https://developers.google.com/identity/sign-in/web/backend-auth
2. On backend: GoogleIdToken idToken = verifier.verify(googleToken); cause issue

Code example

try {

            GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(new NetHttpTransport(), getDefaultJsonFactory())
                    // Specify the CLIENT_ID of the app that accesses the backend:
                    .setAudience(Collections.singletonList(clientId))
                    // Or, if multiple clients access the backend:
                    //.setAudience(Arrays.asList(CLIENT_ID_1, CLIENT_ID_2, CLIENT_ID_3))
                    .build();

            GoogleIdToken idToken = verifier.verify(googleToken);

Stack trace

verifier.verify runs up to BaseEncoding.class:

public final byte[] decode(CharSequence chars)

Remote debugger shows: "java.io.IOException: Unrecognized character: -"

External references such as API reference guides

https://developers.google.com/identity/sign-in/web/backend-auth

Any additional information below

At remote tomcat debugger I took token id and used it in
https://oauth2.googleapis.com/tokeninfo?id_token

It showed decoded access token with all correct information.

[codyoss]

Hey @yerzhik thanks for the report. I will investigate.

[codyoss]

@yerzhik how are you getting googleToken? Are you still having this issue?

[yerzhik]

I downgraded the library version and the same code worked

…

On Sat, Nov 23, 2019 at 6:39 Cody Oss ***@***.***> wrote: @yerzhik <https://github.com/yerzhik> how are you getting googleToken? Are you still having this issue? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1403?email_source=notifications&email_token=ABE7BLOWZRG7L4KCT2PZZ53QVBGRXA5CNFSM4JF4I54KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEE66KHQ#issuecomment-557704478>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABE7BLOG5DDX5MTSEQL4APDQVBGRXANCNFSM4JF4I54A> .

[zelda2626]

I downgraded the library version and the same code worked
.

What version? I tried several and doesn't work...

[yerzhik]

Hey @yerzhik thanks for the report. I will investigate.

I just followed official tutorial/example codes. I can put it here later today if needed.

[codyoss]

@yerzhik could you share what version worked, and did not work for you? This verify code seems like it has been pretty stable so if there is something going on here I think it is in one of the dependencies of the lib.

[tobingj]

Looks like setAudience(Collections.singletonList(clientId)) is broken. Comment this code to verify the token. For example,
GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, jsonFactory)
// Specify the CLIENT_ID of the app that accesses the backend:
.setIssuer("accounts.google.com")
//.setAudience(Arrays.asList(clientId))
// Or, if multiple clients access the backend:
// .setAudience(Arrays.asList(CLIENT_ID_1, CLIENT_ID_2, CLIENT_ID_3))
.build();

[codyoss]

I have tried to reproduce this on master, but was unsuccessful. Closing for now. If you are still having issues please reopen with more details. Thanks.

[melvzgungog214]

@codyoss I encountered same issue as this. I used google-api-client-1.30.9.jar. Please help me. I need to fix this ASAP.

[melvzgungog214]

@codyoss In frontend side, it's working fine but the problem is on verifying the id token. This is my code:

if (StringUtils.isNotBlank(idtoken) && idtoken != null) {
GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(new NetHttpTransport(), new JacksonFactory())
.setAudience(Collections.singletonList(GOOGLE_CLIENT_ID))
.build();

        try {
            GoogleIdToken idToken = verifier.verify(idtoken);
            
            if (idToken != null) {
                Payload payload = idToken.getPayload();
                
                String userId = payload.getSubject();
                logger.debug("User ID: " + userId);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

This is the error in my CLI:

java.lang.IllegalArgumentException: java.io.IOException: Unrecognized character: -
at com.google.common.io.BaseEncoding.decode(BaseEncoding.java:237)
at com.google.api.client.util.Base64.decodeBase64(Base64.java:101)
at com.google.api.client.json.webtoken.JsonWebSignature$Parser.parse(JsonWebSignature.java:536)
at com.google.api.client.googleapis.auth.oauth2.GoogleIdToken.parse(GoogleIdToken.java:58)
at com.google.api.client.googleapis.auth.oauth2.GoogleIdTokenVerifier.verify(GoogleIdTokenVerifier.java:191)

I used play-1.4.6 JAVA Framework
JAVA VERSION Details:
openjdk version "1.8.0_242"
OpenJDK Runtime Environment (AdoptOpenJDK)(build 1.8.0_242-b08)
OpenJDK 64-Bit Server VM (AdoptOpenJDK)(build 25.242-b08, mixed mode)

OS: MACOS Catalina

Any thoughts here? @codyoss

[melvzgungog214]

FYI, @codyoss I created separate issue of this and it is under #1529