Sign in with Google: how OAuth lets an app in without your password
OAuth redirect: where you really type your password when you sign in with Google
You tap Sign in with Google on an app you met five minutes ago. So where does your Google password really go, and does the app ever see it?
-
1
You open supperclub.example and tap Sign in with Google. No password box appears on the app's page. Instead, the app sends your browser away, to Google.
-
2
Your browser leaves the app and opens a page of Google itself, at accounts.google.com. This jump from one website to another is called a redirect.
-
3
Here you type your Google password, on Google's own page. The app is not on this page: what you type goes to Google and nowhere else.
-
4
Often you type nothing at all. If you signed in to Google earlier, your browser still holds Google's cookie, a small piece of data that says you are signed in, and Google only asks which account to use.
-
5
Either way, Google now knows it is you. Yet the app sent you there for a reason, and Google has a question for you before you go back.
-
Quick check
A new game wants you to sign in.
Show the answer
No. The real one sends you to Google's own page, at accounts.google.com. In the game's own box, the game reads every letter you type.
-
Go further
Two names behind the story.