On Tue, Dec 30, 2008 at 8:27 PM, hgarcia_101685
<[email protected]> wrote:
>
> I'm fairly new to this technology. I'm working with the google
> calendar tutorial in the google code website. I noticed that after I
> log into google, grant access and return back to my website, the token
> shows up in the adress bar. I don't know if that's safe or not? or
> normal? is this like the POST and GET method of sending information
> or am I far off? Any insight would be appreciated.
I'm assuming that your concern is somebody eavesdropping on the HTTP
conversation and stealing the token, as opposed to the service you
authorized using the token maliciously or somebody digging through
your browser history to recover the token (both of which are outside
our control).
If you're using the JavaScript client, then it's secure because our
authentication servers use HTTPS the token is included as a URL
fragment (it's after the '#'), meaning it's never sent over the
network to the third-party service.
If you're not using the JavaScript client, then things are a little
more complicated. In short:
- If the third-party server is using HTTP and has NOT registered a
signing key with us, then there is a brief window of vulnerability
after a single-use token issued and before that token is exchanged for
a session token. Because of this, we automatically display the
following text to users during the signin process in this situation:
This website has not registered with Google to establish a secure
connection for authorization requests. We recommend that you continue
the process only if you trust the following destination: <Your URL
Here>
- If the third-party server is using HTTP and has registered a
signing key with Google, then you should be fine since an attacker
cannot use the single-use token. No warning is displayed in this case.
- If you're using HTTPS on the third-party server as the 'next' URL,
then you should also be fine since the token will be encrypted in
transit. However, since we can't authenticate the third-party server,
users will still receive the warning mentioned above. This can be
fixed by registering a signing key.
This is described here:
http://code.google.com/apis/accounts/docs/AuthSub.html#signingrequests
http://code.google.com/apis/accounts/docs/OAuth.html#SigningOAuth
--
Trevor Johns
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Google Calendar Data API" group.
To post to this group, send email to
[email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/google-calendar-help-dataapi?hl=en
-~----------~----~----~----~------~----~------~--~---
