Subversion Repositories SmartDukaan
(root)/trunk/profitmandi-fofo/src/main/java/com/spice/profitmandi/web/util/GoogleTokenUtil.java – Rev 37913
Rev 33741 | Compare with Previous | Directory listing | Details | Blame | View Log | RSS feed
Last modification
- Rev 37913 – 24 d 15 h
- Author: amit
- Log message:
- fix(security): fofo /login no longer trusts a request email when Google verification fails
LoginController.login fell back to emailId = emailIdOrMobileNumber whenever
googleTokenUtil.getEmailId(token) threw, so any bogus token plus any email
logged the caller in as that user. Verification failure now fails the login.
GoogleTokenUtil also requires tokeninfo aud == google.api.key (our web client
id, same value the login page uses) and email_verified == true.
Password login is unchanged.
