(idToken string, allowedAppID []string)
| 52 | } |
| 53 | |
| 54 | func verifyGoogle(idToken string, allowedAppID []string) (*GoogleResponse, error) { |
| 55 | destUrl := googleTokenInfoURL + idToken |
| 56 | |
| 57 | res, err := http.Get(destUrl) |
| 58 | if err != nil { |
| 59 | return nil, base.HTTPErrorf(http.StatusGatewayTimeout, "Unable to send request to Google API: %v", err) |
| 60 | } |
| 61 | defer func() { _ = res.Body.Close() }() |
| 62 | |
| 63 | decoder := base.JSONDecoder(res.Body) |
| 64 | |
| 65 | var response GoogleResponse |
| 66 | err = decoder.Decode(&response) |
| 67 | if err != nil { |
| 68 | return nil, base.HTTPErrorf(http.StatusBadGateway, "Invalid response from Google token verifier") |
| 69 | } |
| 70 | |
| 71 | if response.ErrorDescription != "" { |
| 72 | return nil, base.NewHTTPError(http.StatusUnauthorized, response.ErrorDescription) |
| 73 | } |
| 74 | |
| 75 | if !isValidAud(response.Aud, allowedAppID) { |
| 76 | return nil, base.HTTPErrorf(http.StatusUnauthorized, "Invalid application id, please add it in the config") |
| 77 | } |
| 78 | |
| 79 | return &response, nil |
| 80 | } |
| 81 | |
| 82 | func isValidAud(aud string, allowedAppID []string) bool { |
| 83 | for _, s := range allowedAppID { |
no test coverage detected