Refreshing an access token received from Google Identity Services / React App - reactjs

I have a trouble right now with an access token received from Google Identity Services.
Some details about the case. I have full stack application, back-end based on Spring/Webflux/Hibernate-Reactive and frond end based on React. I'm using the google login feature from Google Identity Services with this react library #react-oauth/google.
I'm using the received "credential" after successful login for back-end access. Everything works like expected except that I there is no refresh token in the response after successful login. The token expires after 1 hour and a user must be prompted to login again to receive a new token, which is horrible!
So, how to refresh this token, any Idea?
I could not found more info on google side, that's why I am writing here.

So I found the solution by myself. I will post it here, in hoping to help someone else who is struggling with this problem.
So using the react library #react-oauth/google I used the useGoogleLogin hook. I added "flow: 'auth-code'" to function's options object.
const login = useGoogleLogin({
onSuccess: codeResponse => console.log(codeResponse),
flow: 'auth-code',
});
The function is triggered by click on simple button.
After successful login from the user, in the response object we can find a code property. We can exchange the code for an access,refresh and id token by calling the google oauth2 api:
curl --location --request POST 'https://oauth2.googleapis.com/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=your_client_id' \
--data-urlencode 'client_secret=your_client_secret' \
--data-urlencode 'code=recieved_code_after_login' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'redirect_uri=one of your redirect uri's listed in your
credential'
after successful request access,refresh and id token are received.
refreshing the token also so simple:
curl --location --request POST 'https://oauth2.googleapis.com/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=your_client_id' \
--data-urlencode 'client_secret=your_client_secret' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token=received_refresh_token'
Here is the original Google documentation: https://developers.google.com/identity/protocols/oauth2/web-server#httprest_3
!important!
Remember that the refresh is valid until access is revoked. When you refresh the tokens, a new refresh token is not coming with the response. For further refreshes, you can use the same refresh token, receive by exchange.

Related

How to deploy Mule application jar file in Runtime Fabric with Anypoint Runtime Manager REST API without going though Anypoint Exchange

I want deploy a jar file which is availble for me in my pc to RTF Mule server managed by AKS.I want use ARM rest api.
curl --location --request POST 'https://anypoint.mulesoft.com/hybrid/api/v1/applications' \
--header 'x-anypnt-env-id: e21c3d' \
--header 'x-anypnt-org-id: 321d5ac3e' \
--header 'Authorization: Bearer 4f4e0ce1340c29f7baf9' \
--header 'Content-Type: multipart/form-data' \
--header 'Cookie: XSRF-TOKEN=TLy3BYtp-pshrqU42; mulesoft.sess=eyJpeyJ1c2VyX2lkIjoiZmU2YWZlMGQtMTZhZC00NDEwLTk1YTUtNDQ5MzUyZTgwMmUzIn19fQ==; mulesoft.sess.sig=IlvX_h9vp_ijZt_hAh0gM5WXoEs' \
--form 'file=#"/C:/Users/wb587070/AnypointStudio/s7-12-workspace/test-project/target/test-project-5.0.0-dev393-mule-application.jar"' \
--form 'artifactName="test-project"' \
--form 'targetId="30683393-4494-4d21-87c6-be27679ed021"' \
I am using curl to deploy jar file but I am getting "403 forbidden error"
In this knowledge article the application is deployed first to Exchange, and then from Exchange to the Runtime Fabric server. Is there any way by using Anypoint Runtime Manager REST API to deploy application straight to server with out using Exchange
No. Application deployments must go through the Anypoint Exchange repository first.
You can use Anypoint CLI as an alternative to the REST API however it still requires deploying to Exchange first: https://docs.mulesoft.com/anypoint-cli/3.x/runtime-fabric-apps#runtime-mgr-application-deploy

IAP from Service account OIDC Token : 401 Unauthorized

Hello, in a sh script i try to call an api in App Engine Standard (with a POST) behind an IAP.
I use a service account who have the "IAP-secured Web App user" permission.
The service account is from an another account that the IAP.
I first generate an OpenId connect :
OIDC_token_response=$(curl -X POST \
-H "Content-Type: application/json" \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
-H "Accept: application/json" \
--data '{"audience":"{CLIENT_ID_IAP","includeEmail":true}' \
-s --write-out "HTTP_CODE:%{http_code}" \
https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${MY_SERVICE_ACCOUNT:generateIdToken)
Then i use the token :
api_response=$(curl -X POST -H "Authorization: Bearer "${OIDC_token} -s --write-out "HTTP_CODE:%{http_code}" https://{MY-APP}.appspot.com/my-api/)
The answer is :
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>401 Unauthorized</title>
<h1>Unauthorized</h1>
<p>Unauthorized</p>
HTTP_CODE:401
Any idea ?
Regards
The error was not at the IAP Level : the 401 error was returned by the app engine application.
The IAP connection is OK.
Sorry for this post.

Calling Google IAM generateAccessToken API always returns error

I'm facing the issue where I am not able to generate an Access Token for Google IAM Service Account using this method .
I've got my personal OAuth2 access token using:
gcloud auth application-default print-access-token
I've got all the necessary roles (roles/iam.serviceAccountTokenCreator) but when I cURL the API I always get an error response:
{
"error": {
"code": 400,
"message": "Request contains an invalid argument.",
"status": "INVALID_ARGUMENT"
}
}
This is how full curl request looks like:
curl -X POST --header 'Content-Type: application/json' --header 'authorization: Bearer ya29.AASDSADASDASDi9C1yAXXXXXXZzLtDDrCAzblqF_qi5sKvMZcHieBADASDASDTNJiOKrqJBffb4Moh3gTgiTbDgMIF1XDQU5JZ31aACs0aUbI4wgeqV2Q' https://iamcredentials.googleapis.com/v1/projects/<PROJECT_NAME>/serviceAccounts/<SA_NAME>#<PROJECT_NAME>.iam.gserviceaccount.com:generateAccessToken -d '{"scope": ["https://www.googleapis.com/auth/cloud-platform"]}'
Thanks
You have two problems in your API call.
The Service Account Name is a path parameter and must be URL encoded. The # character is not valid. Use %40 in its place (as an example of correct encoding).
The URI specifies a PROJECT_NAME. This is not correct. You need to use a - (hyphen/dash character). Example projects/-/serviceAccounts.
You also need to have the permission iam.serviceAccounts.getAccessToken attached to one of the roles that are assigned to the account that created the request Access Token use in this API request. This will cause a different error if incorrect. Just a tip as you get to the next step.

Using HTTP Request for Google Dialogflow

https://api.dialogflow.com/v1/query?v=20150910&contexts=shop&lang=en&query=apple&sessionId=12345&timezone=America/New_York
Headers:
Authorization: Bearer YOUR_CLIENT_ACCESS_TOKEN
How do i use the above code to make a HTTP Request in Google Dialogflow? How do i add headers as a part of HTTP request
You can use the Postman application for sending POST request,
Select Post request in Postman Application,
Copy and paste URL https://api.dialogflow.com/v1/query?v=20150910&contexts=shop&lang=en&query=apple&sessionId=12345&timezone=America/New_York
In headers section, choose Authorization as key and paste the Bearer YOUR_CLIENT_ACCESS_TOKEN
Then, if you click send you will get the proper response in a body.
An easy start is to use curl from the command line as in the documentation:
curl \
-H "Authorization: Bearer YOUR_CLIENT_ACCESS_TOKEN" \
"https://api.dialogflow.com/v1/query?v=20150910&contexts=shop&lang=en&query=apple&sessionId=12345&timezone=America/New_York"
Just copy the whole thing and paste it into your command line and you will get a json response.
Ref: https://dialogflow.com/docs/reference/agent/query#get_query_sample

Access Coinbase Create Account API using curl without OAuth2

I am using Coinbase Wallet Endpoints of Coinbase API in my application and trying to hit create_account API https://developers.coinbase.com/api/v2#create-account using curl without OAuth2. According to Coinbase documentation, curl command would be like:
curl https://api.coinbase.com/v2/accounts \
-X POST
-H 'Content-Type: application/json'
-H 'Authorization: Bearer
abd90df5f27a7b170cd775abf89d632b350b7c1c9d53e08b340cd9832ce52c2c'
-d '{"name": "New wallet"}'
I am unable to figure out what will be the value of access token and how I will get it without using OAuth2 request.
Please guide me that "How I will get Bearer access token without using OAuth2?".

Resources