Authenticating with Google with OAuth 2.0 and Userinfo API, what does it mean for the email to be verified?

Question

I'm getting started using OAuth 2.0 with Google for authentication. I'm using Google's Using OAuth 2.0 for Login document, and everything is working great. I have a question about the verified_email field. It is documented like this:

verified_email : A flag that indicates whether or not Google has been able to verify the email address.

But what does that mean, exactly? Is it considered best practice to make sure the email is verified when authenticating in this way, or is the fact that we've gotten back a response with the correct email proof enough that the user is the owner of said email account?

Answer 1

It means different things whether the mail is hosted by google, or not.

-If the user has an email address @gmail.com or @hosted-example.com, where hosted-example.com is a domain using Google apps (and in particular hosted Gmail), then Google accounts also implement access control/login to the email account. In this case, the verified_email bit is always 'true', but in fact the guarantee is stronger than "Google has been able to verify the email address".

• On the other hand, if the email address is on a non-Google-hosted account, e.g. @yahoo.com, it means that Google was able to validate it (typically by sending the user an email and obtaining confirmation of receipt) at some point in time. The information may not be current: The user may have lost control over that account. So in this case, the information is possibly useful in terms of spam signal, but probably should not be relied upon exclusively for some more critical operation, e.g., account recovery.