Google signin in Android app to consume Cloud Endpoints backend

Question

I am writing an Android app with a Google Cloud Endpoints backend, and I want to restrict my backend with a Google signin.

I have followed the Android instructions, and have successfully logged in. In other words, I have received a token, which I can then pass to the server and verify the user it stands for. Great.

However, I am missing the bigger picture here. Questions:

1. Am I supposed to be sending this token with each request back to the server, and repeat the process of verifying it in each request?
2. If yes, the token will expire at some point (1 hour I believe). I suppose the user does not have to login again, there should be away to avoid this, right?
3. Is a way to refresh the token (I think Google Signin is OAuth2)?
4. And most importantly, is all this the standard way someone uses Google signin to protect their backend? I was expecting this to be very straightforward process, since I am only using Google products. However, I am finding myself lost in pages and pages of documentation on Android and Cloud Enpoints with pieces of the puzzle.

Any help or insight is appreciated.

Answer 1

I have not used android authentication but google uses outh2 for all its authentication. Google SDKs may help you alleviate some of the pain of using oauth2. To answer your questions

1. Yes - You are in the world of token based authentication and you do send the token with every request.
2. Yes. token will expire after an hour. To get around this when you first do an oauth2 authentication, you also get a refresh token. When the token of the user expires you use the refresh token to get the new token. This refresh token can be stored on the client side. Client will find during one of its requests that that existing token is expired and would request for a new token using refresh token
3. Yes you use the google refresh token URL to use the refresh token and get the new token. I have given the important oauth URLs of google below.
4. This is indeed oauth2 process my friend.

since you are using cloud endpoint I believe that you would be making the authentication endpoints.

You generally make the following endpoints when doing oauth2 authentication using a service provider(google, facebook, github, etc):

https://webiste.com/auth/signin/{provider}
https://webiste.com/auth/callback/{provider}
https://webiste.com/auth/refresh/{provider}

Following are the google URLs for oauth2 that you would use:

oauth_url: 'https://accounts.google.com/o/oauth2/v2/auth',  //start auth
token_url: 'https://accounts.google.com/o/oauth2/token',   //get id_token, access_token, refresh_token token
refresh_token_url : 'https://www.googleapis.com/oauth2/v4/token',
token_info_url: 'https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=',  //validate token

You would also want to go through google's oauth2 documentation at https://developers.google.com/identity/protocols/OAuth2.