How to validate the id_token value received from Google OpenID Connect authentication response?

As you can see from the previous tutorials, you can easily decode the "id_token" value received from Google OpenID Connect authentication response using a simple PHP script.

After decoding, you can get all information about the end user from the body component, and trust it without any validation.

But, since the "id_token" is included in the authentication response delivered over the public Internet, you should not trust it and perform a number validation steps:

1. Data structure validation.

• The "id_token" must have 3 components.
• Each component must be a Base64URL encoded string.
• The decoded "Header" and 'Body" (also called "Payload") components must be JSON strings.

2. Data attributes validation.

• The "Header " component must have all required attributes and values. For example, "typ": "JWT", "alg": "...", and "kid": "..." are required.
• The "Body" component must have all required attributes and values. For example, "iss" must be "accounts.google.com". "aud": "..." must match the "client_id" value in your authentication request.

3. Timestamp attributes validation. This will prevent someone to repost the authentication response to your server script at a later time.

• "iat": "1353601026" specifies the "Issue AT" time. It must be very recent.
• "exp": "1353604926" specifies the "EXPiration" time. It must be a future time.

4. "nonce" protection and validation. This will prevent someone to repost the authentication response again immediately.

• Generate a new random value for the "nonce" and included in your authentication request and save it into the server cache.
• Take the "nonce" value out of the "Body" component of the authentication response and search it in the server cache.
• If a match found, the "nonce" is valid and remove it from the server cache.
• If no match found, the "nonce" is invalid. Someone is hacking your application, or Google OpenID Connect service is sending a duplicate authentication response.
• Remove old "nonce" values from the server cache. Some authentication requests will never result any authentication response, because not all end users are going to complete their Google OpenID Connect sign-on processes.

5. Signature validation. This is to ensure the entire authentication response message has not been modified by someone else. See next tutorial on how to perform "id_token" signature validation.

 

⇒ Validate Google OpenID Connect id_token Signature

⇐ Decode Google OpenID Connect id_token

⇑ Google OpenID Connect Integration

⇑⇑ OpenID Tutorials