[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eIAP query parameters, specifically \u003ccode\u003egcp-iap-mode\u003c/code\u003e, can be used to perform actions like retrieving user identity or clearing the login cookie.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcp-iap-mode=IDENTITY\u003c/code\u003e parameter provides a JSON dictionary with the user's email and sub information, which can be used for personalization or data capture, even if the user lacks app access.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcp-iap-mode=CLEAR_LOGIN_COOKIE\u003c/code\u003e parameter can be used to clear all IAP-issued cookies for the app, potentially prompting a re-authentication process.\u003c/p\u003e\n"],["\u003cp\u003eIAP facilitates JWT verification testing using \u003ccode\u003egcp-iap-mode=SECURE_TOKEN_TEST\u003c/code\u003e along with parameters to simulate different invalid JWT scenarios, such as incorrect signatures or expiration dates.\u003c/p\u003e\n"],["\u003cp\u003eThe presence of the \u003ccode\u003eX-Goog-IAP-Generated-Response\u003c/code\u003e HTTP header indicates that a response originated from IAP, allowing applications to differentiate between IAP-generated errors and application-generated errors.\u003c/p\u003e\n"]]],[],null,["# Using query parameters and headers\n\nThis page describes how to use Identity-Aware Proxy (IAP)\nquery parameters and headers to enhance your application UI or provide\ntroubleshooting options.\n\nQuery Parameters\n----------------\n\nDifferent actions can be performed by setting the parameter `gcp-iap-mode` in the URL query string.\nThese query parameters can be included with any path, not just the root URL.\n\n### Passing user identity\n\nPassing the following parameter value returns a JSON dictionary with the user's identity:\n\n\u003cvar translate=\"no\"\u003eYOUR_APP_URL\u003c/var\u003e`?gcp-iap-mode=IDENTITY`\n\nThis is available from any signed-in Google account, even if the account\ndoesn't have access to the app. You can navigate to the URL directly or you can\nreference it to make requests to the URL. Following is an example value returned\nby the URL:\n\n`{\"email\":\"accounts.google.com:`\u003cvar translate=\"no\"\u003eUSER_EMAIL\u003c/var\u003e`\",\"sub\":\"accounts.google.com:118133858486581853996\"}`\n\nYou might find this value useful to personalize your app, such as by displaying\nthe user's name, to pass identity to another page, or capture usage data in\nlogs.\n\n### Clearing user login\n\nThe following parameter value clears the IAP login cookie:\n\n\u003cvar translate=\"no\"\u003eYOUR_APP_URL\u003c/var\u003e`?gcp-iap-mode=CLEAR_LOGIN_COOKIE`\n\nPassing this parameter clears all the IAP-issued cookies\nfor your app and navigates the browser to `YOUR_APP_URL`. If your browser has a\nvalid session with the identity provider (IdP) of your app, a silent sign-in\nmight happen when there is only one account in use with the IdP. If there are\nmultiple accounts in use, an account selection page opens to allow profile switching.\n\n### Testing JWT verification\n\nIAP helps you test your JWT verification logic by passing\ninvalid JWTs to testing webpages.\n\nFor example, IAP passes a JWT with an invalid signature\nfor any request that contains the query parameters\n`gcp-iap-mode=SECURE_TOKEN_TEST` and `iap-secure-token-test-type=SIGNATURE`.\nYour verification logic should catch the invalid signature.\n\nYou can test your verification logic against any of the following scenarios by\nappending the appropriate parameters to a request.\n\nSpecial headers\n---------------\n\n### Detecting responses from IAP\n\nWhen IAP generates an HTTP response, such as when it denies\naccess (403) or requests authentication (302 or 401), it adds the\n`X-Goog-IAP-Generated-Response` HTTP response header. By detecting the presence\nof this header, you can perform actions like:\n\n- Distinguish between error messages generated by IAP and error\n messages generated by your application.\n\n- Detect when IAP credentials need to be added to a\n request."]]
