From 9af778fc2d1ffac142628da4f9e2fd027dbfec7c Mon Sep 17 00:00:00 2001 From: Vitaly Takmazov Date: Tue, 19 Apr 2022 20:43:21 +0300 Subject: Google sign in: validate client id --- src/main/java/com/github/scribejava/apis/GoogleTokenVerifier.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/main/java/com/github/scribejava') diff --git a/src/main/java/com/github/scribejava/apis/GoogleTokenVerifier.java b/src/main/java/com/github/scribejava/apis/GoogleTokenVerifier.java index 35a9d832..a7d48a34 100644 --- a/src/main/java/com/github/scribejava/apis/GoogleTokenVerifier.java +++ b/src/main/java/com/github/scribejava/apis/GoogleTokenVerifier.java @@ -3,6 +3,7 @@ package com.github.scribejava.apis; import java.net.MalformedURLException; import java.net.URL; import java.text.ParseException; +import java.util.Collections; import java.util.Map; import java.util.Optional; @@ -20,11 +21,10 @@ import com.nimbusds.jwt.proc.DefaultJWTProcessor; public class GoogleTokenVerifier { - public static Optional validateToken(String idToken) { + public static Optional validateToken(String clientId, String idToken) { // Create a JWT processor for the access tokens - ConfigurableJWTProcessor jwtProcessor = - new DefaultJWTProcessor<>(); + ConfigurableJWTProcessor jwtProcessor = new DefaultJWTProcessor<>(); // The public RSA keys to validate the signatures will be sourced from the // OAuth 2.0 server's JWK set, published at a well-known URL. The RemoteJWKSet @@ -49,7 +49,7 @@ public class GoogleTokenVerifier { jwtProcessor.setJWSKeySelector(keySelector); // Set the required JWT claims for access tokens issued by the server - jwtProcessor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<>()); + jwtProcessor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<>(Collections.singleton(clientId), null, null, null)); // Process the token Map claimsSet; -- cgit v1.2.3