Google Authentication : OAuth2.0 Vs OpenID Connect

Question

I am evaluating the possible options provided by Google for adding google signin in my web application. The possible options as i see are

1. Google+ Signin
2. OAuth2.0
3. OpenID Connect ( OAuth2.0 for Login )

I didnt go with 1st one as it limits the API calls i can make in a day to 10000

Out of 2 & 3, i am inclined to go for 3rd. I dont really need API authorization and i am not concerned about access token expiration in my case. Once i receive user profile from Google, my web app will manage its own session of the user and does not need to query Google for any other data related to the user. And as per Google documentation, #3 allows me to customize User consent screen, while 1 & 2 dont.

Any comments on my comparison between 2 & 3 ?

Answer 1

In fact 2. is comprised of a Google specific usage/extension of OAuth 2.0 to establish user identity on top of the authorization provided by core OAuth 2.0. Using 2. you would have to ensure that you only receive the access token in a code flow and you would have to perform a Google specific introspection call to find out who the user is, where the user's identity is returned in Google specific claims.

On the other hand,3. is a standardized way to login users through a 3rd-party provider so it is a future safe choice for which you'll find more support in libraries/sdk's (well at least in the near future).