Sign in with Google: how OAuth lets an app in without your password
ID token and OpenID Connect: how an app learns who you are from Google
OAuth was built to let apps reach your data, not to say who you are. So how does Sign in with Google tell an app it is really you, in a way nobody can fake?
-
1
Rono's app found a free Thursday, but it cannot say whose Thursday it is. OAuth was built to let an app reach things, not to tell it who you are, and a ticket to a calendar is not a name.
-
2
The app could simply ask for your email address. But anyone can type anyone's address: the app needs Google to say who you are, in a way nobody else can fake.
The rest of this episode is for subscribers
Subscribe to read every premium episode. You can cancel when you want.
Paid yearly: $99 instead of $119.88