Class GoogleIdTokenVerifier (1.33.4)

Beta
Thread-safe Google ID token verifier.

Call #verify(IdToken) to verify a ID token. Use the constructor #GoogleIdTokenVerifier(HttpTransport, JsonFactory) for the typical simpler case if your application has only a single instance of GoogleIdTokenVerifier. Otherwise, ideally you should use #GoogleIdTokenVerifier(GooglePublicKeysManager) with a shared global instance of the GooglePublicKeysManager since that way the Google public keys are cached. Sample usage:

 GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, jsonFactory)
        .setAudience(Arrays.asList("myClientId"))
        .build();

 ...

 if (!verifier.verify(googleIdToken)) {...}
 

Deprecated. (scheduled to be removed in 1.18) Use #getPublicKeysManager() and GooglePublicKeysManager#getExpirationTimeMilliseconds() instead.

Returns the expiration time in milliseconds to be used with Clock#currentTimeMillis() or 0 for none.

Returns the JSON factory.

Deprecated. (scheduled to be removed in 1.18) Use #getPublicKeysManager() and GooglePublicKeysManager#getPublicCertsEncodedUrl() instead.

Returns the public certificates encoded URL.

Deprecated. (scheduled to be removed in 1.18) Use #getPublicKeysManager() and GooglePublicKeysManager#getPublicKeys() instead.

Returns the public keys.

Upgrade warning: in prior version 1.16 it may return null and not throw any exceptions, but starting with version 1.17 it cannot return null and may throw GeneralSecurityException or IOException.

Returns the Google public keys manager.

Returns the HTTP transport.

Deprecated. (scheduled to be removed in 1.18) Use #getPublicKeysManager() and GooglePublicKeysManager#refresh() instead.

Downloads the public keys from the public certificates endpoint at #getPublicCertsEncodedUrl.

This method is automatically called if the public keys have not yet been initialized or if the expiration time is very close, so normally this doesn't need to be called. Only call this method explicitly to force the public keys to be updated.

Verifies that the given ID token is valid using the cached public keys.

It verifies:

• The RS256 signature, which uses RSA and SHA-256 based on the public keys downloaded from the public certificate endpoint.
• The current time against the issued at and expiration time (allowing for a 5 minute clock skew).
• The issuer is "accounts.google.com" or "https://accounts.google.com".

Verifies that the given ID token is valid using #verify(GoogleIdToken) and returns the ID token if succeeded.