Add Google login to FTW #1376
Add Google login to FTW #1376
Conversation
OtterleyW
force-pushed
the
google-login
branch
3 times, most recently
from
6b89b4d
to
0167d18
Compare
server/api/auth/loginWithIdp.js
Outdated
| @@ -99,7 +99,9 @@ module.exports = (err, user, req, res, clientID, idpId) => { | |||
| } | |||
| } | |||
| }) | |||
| .catch(() => { | |||
| .catch(err => { | |||
| console.error(err); | |||
There was a problem hiding this comment.
What kind of data the 'err' contains? Is there something that should not end up to logs?
There was a problem hiding this comment.
Maybe all the console.logs in the server routes could be checked and potentially enforce the usage of log.js instead?
| const PORT = parseInt(process.env.REACT_APP_DEV_API_SERVER_PORT, radix); | ||
| const rootUrl = process.env.REACT_APP_CANONICAL_ROOT_URL; | ||
| const clientID = process.env.REACT_APP_GOOGLE_CLIENT_ID; | ||
| const clientSecret = process.env.GOOGLE_CLIENT_SECRET; |
There was a problem hiding this comment.
Wondering what this is used for. The Google Web login reference does not mention using the client secret: https://developers.google.com/identity/sign-in/web/reference. Apparently this is used to fetch user profile info but shouldn't the access token suffice for that?
What if this is left out? Does fetching the profile fail?
There was a problem hiding this comment.
I tested this without clientSecret and it didn't work. At least the Passport.js expects that the client secret is there. After some investigation I think I found the answer from Google's docs: For example, a JavaScript application does not require a secret, but a web server application does.
It's a little confusing because we are also using JavaScript in the FTWs server. But anyway, when we don't use Google's JavaScript client directly for the web application but we are handling the authentication in the web server, we need to provide the client secret too.
…he handling in log in and create endpoints
…cebook related values
…and use it in button
OtterleyW
force-pushed
the
google-login
branch
from
0167d18
to
26350af
Compare
This PR adds Google login to FTW
It follows the same logic as Facebook login and uses the
createUserWithIdpandloginWithIdpendpoints which were added with Facebook login. You can find more information from Facebook login PR #1366