Qfyilyi

I have existsing C# ASP.NET WebAPI 2.0 project with a few methods for another website. This WebAPI project has no any authentication and returns JSON data. The first method takes two parameters from website: Email and Password then checks it in MS SQL table and returns JSON (success or wrong): if success then i create some token and add token with user_id to another MS SQL table. This method returns token if everything is ok.

    [HttpPost]

    [Route("api/v1/auth/email-login")]

    [ActionName("EmailLogin")]

    public IHttpActionResult Postpipeline_EmailLogin([FromBody] PostAuthItem postAuthItem)

    {

        try

        {

            int? userId = db.USERS_GetUserId(postAuthItem.Email, postAuthItem.Password).FirstOrDefault();

            if (userId == null)

            {

                return Ok(new

                {

                    Error = "Wrong email or password!"

                });

            }

            else

            {

                string token = this.GetToken(40);



                db.TOKENS_Add(userId, token);

                db.SaveChanges();



                return Ok(new

                {

                    Token = token

                });

            }

        }

        catch (Exception ex)

        {

            return new System.Web.Http.Results.ResponseMessageResult(Request.CreateErrorResponse((HttpStatusCode)400, new HttpError("Http error! " + ex.Message + " " + ex.InnerException.Message)));

        }

    }

Now authorization via Google has been added to the website. So i need to add new method, that will check success or wrong authentication via Google. Website developer send me only access_token like this:

Request:

{

    "access_token": "ya47.Kdd_KeQ0mQiTzom20dQ6M83742KMYQpkCUqCZv0UbU2CjhMIuxIT5ugRXwIrOUcV-TGbUztMiRDRPzh0INrGgh7gqXyaIfyQAnNMmP0GhXRc6bbanEiPxV7fK9ss"

}

If there is possibility to check valid Google user with this request?

You can go directly though the Userinfo endpoint

GET /userinfo/v2/me HTTP/1.1

Host: www.googleapis.com

Content-length: 0

Authorization: Bearer 29.GltcBsh3Q-qbIEslOBcifBKlRh2GfE0-P11tDMgBx_WdWdH1TG6iWkDtzj0e_zIERaDyq6b_oseOIiSpG3iO0LIeQuAAyn5VVDe50WVmdtWhrMiN27wTsUJY0jxP

This will return infomation about the user in question

{

  "picture": "https://lh5.googleusercontent.com/-a1CWlFnA5xE/AAAAAAAAAAI/AAAAAAAAl1I/UcwPajZOuN4/photo.jpg", 

  "name": "Linda Lawton", 

  "family_name": "Lawton", 

  "locale": "en", 

  "gender": "female", 

  "link": "https://plus.google.com/+LindaLawton", 

  "given_name": "Linda", 

  "id": "117200475532672775346"

}

After a user successfully signs in, get the user's ID token:

function onSignIn(googleUser) {

  var id_token = googleUser.getAuthResponse().id_token;

  ...

}

Then, send the ID token to your server with an HTTPS POST request:

var xhr = new XMLHttpRequest();

xhr.open('POST', 'https://yourbackend.example.com/tokensignin');

xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');

xhr.onload = function() {

  console.log('Signed in as: ' + xhr.responseText);

};

xhr.send('idtoken=' + id_token);

You can view the complete documentation in:
Authenticate with a backend server