diff --git a/spec/AuthenticationAdapters.spec.js b/spec/AuthenticationAdapters.spec.js index 53b701f544..a42017769b 100644 --- a/spec/AuthenticationAdapters.spec.js +++ b/spec/AuthenticationAdapters.spec.js @@ -701,7 +701,7 @@ describe('google auth adapter', () => { fail(); } catch (e) { expect(e.message).toBe( - 'id token not issued by correct provider - expected: https://accounts.google.com | from: https://not.google.com' + 'id token not issued by correct provider - expected: accounts.google.com or https://accounts.google.com | from: https://not.google.com' ); } }); diff --git a/src/Adapters/Auth/google.js b/src/Adapters/Auth/google.js index 267aebb6df..e156eb1afb 100644 --- a/src/Adapters/Auth/google.js +++ b/src/Adapters/Auth/google.js @@ -6,7 +6,8 @@ var Parse = require('parse/node').Parse; const https = require('https'); const jwt = require('jsonwebtoken'); -const TOKEN_ISSUER = 'https://accounts.google.com'; +const TOKEN_ISSUER = 'accounts.google.com'; +const HTTPS_TOKEN_ISSUER = 'https://accounts.google.com'; let cache = {}; @@ -67,8 +68,8 @@ async function verifyIdToken({id_token: token, id}, {clientId}) { throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, `${message}`); } - if (jwtClaims.iss !== TOKEN_ISSUER) { - throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, `id token not issued by correct provider - expected: ${TOKEN_ISSUER} | from: ${jwtClaims.iss}`); + if (jwtClaims.iss !== TOKEN_ISSUER && jwtClaims.iss !== HTTPS_TOKEN_ISSUER) { + throw new Parse.Error(Parse.Error.OBJECT_NOT_FOUND, `id token not issued by correct provider - expected: ${TOKEN_ISSUER} or ${HTTPS_TOKEN_ISSUER} | from: ${jwtClaims.iss}`); } if (jwtClaims.sub !== id) {