Should I store the ID token persistently in Google sign in? -

-

i using google sign-in in app, , send id token backhand server user signed in , id token retrieved. add id token header of each http request, , validate it, user's id , respond data app. wondering if ok store id token persistently , use future request. id token change or expire time? if so, how new id token? can't find approach other asking user sign in again. or should validate id token once , use id directly in future requests?

don't store id token. google id tokens issued 1 hour validity , expire, can use silentsignin in app new 1 without user interaction. if existing token hasn't expired yet, (cached) version (optionalpendingresult returned have isdone() == true); if expired already, refreshed 1 (but take little longer , optionalpendingresult isdone() false).

here sample code (ui thread, see note below worker thread):

    googlesigninoptions gso = new googlesigninoptions.builder(googlesigninoptions.default_sign_in)             .requestidtoken(getstring(r.string.server_client_id))      mgoogleapiclient = new googleapiclient.builder(this)             .enableautomanage(this /* fragmentactivity */, /* onconnectionfailedlistener */)             .addapi(auth.google_sign_in_api, gso)             .build();  ...      optionalpendingresult<googlesigninresult> opr = auth.googlesigninapi.silentsignin(mgoogleapiclient);     if (opr.isdone()) {         // if user's cached credentials valid, optionalpendingresult "done"         // , googlesigninresult available instantly.         log.d(tag, "got cached sign-in");         googlesigninresult result = opr.get();         handlesigninresult(result);  // result.getsigninaccount().getidtoken(), etc.     } else {         // if user has not signed in on device or sign-in has expired,         // asynchronous branch attempt sign in user silently.  cross-device         // single sign-on occur in branch.         opr.setresultcallback(new resultcallback<googlesigninresult>() {             @override             public void onresult(googlesigninresult googlesigninresult) {                 handlesigninresult(googlesigninresult);  // result.getsigninaccount().getidtoken(), etc.             }         });     }

keep in mind whether call silentsignin on ui thread or worker thread. if call on worker thread, take @ post blockingconnect() + await() simplifies code lot: silent sign in retrieve token googleapiclient


Comments

Post a Comment

Popular posts from this blog

magento2 - Magento 2 admin grid add filter to collection -

-
i created grid in admin xml ui components. need filter collection via url parameter , dont know how achieve that. tried inject requestinterface collection, filter didnt work. di.xml <virtualtype name="slidelistingdataprovider" type="magento\framework\view\element\uicomponent\dataprovider\dataprovider"> <arguments> <argument name="collection" xsi:type="object" shared="false">xxx\xxx\model\resourcemodel\grid\slide\collection</argument> <argument name="filterpool" xsi:type="object" shared="false">slidelistingfilterpool</argument> <!-- define new object filters --> </arguments> </virtualtype> <virtualtype name="slidelistingfilterpool" type="magento\framework\view\element\uicomponent\dataprovider\filterpool"> <arguments> <argument name="applier
Read more

Android volley - avoid multiple requests of the same kind to the server? -

-
i using volley upload list of images server. happens within service. once image uploaded remove list. problem arises when internet connection breaks. when internet connection breaks , comes again thinking of adding images yet uploaded request queue. this can result in more 1 copy of same image saved on server request same image might have gone through before getting rseponse. how can address scenario? i'm not quite sure why you're using service schedule requests volley automatically runs it's request in seperate thread. nevertheless can listen both request results, successful , unsuccessful adding listeners. you can remove image list schedule request using volley. if succeeds can carry on desired, if fails can add again list. public static request getimageuploadrequest(final string image) { response.listener<t> responselistener = new response.listener<t>() { @override public void onresponse(t response
Read more

Combining PHP Registration and Login into one class with multiple functions in one PHP file -

-
i'm trying combine registration, activation , login scripts php website backend script front end developer can pass variables different forms to. my question whether appropriate approach this. don't want have lot of php files different pieces of application developing. far have written following 2 functions login, register , activate user front end developer can call: <?php /** * created phpstorm. * user: karl * date: 26/07/2016 * time: 02:25 */ class users { function register_user($email, $password, $user_name) { $server_name = "localhost"; $u_name = "root"; $db_password = "root"; $db_name = "betamath_graspe"; //email notification variable $from_address="info@slack.com"; //registration form $msg_reg_user='username taken. please choose different username'; $msg_reg_email='email registered'; $msg_reg_active=&#
Read more