After granting a permission for a user of a file $service->permissions->create($fileId, $postBody, $optParams); a notification email is fired and sent to the user.
When hovering over the "Open" button in the email received, a link will be presented at the bottom, as shown below.
https://docs.google.com/spreadsheets/d/<File_ID>/edit?usp=sharing_eip_m&ts=62ace992&sh=CLBp9SC6ETiAuriM&ca=1
see screenshot-->: link sent per mail
Calling $service->files->get($fileId, $optParams); now returns, among other properties, a webViewlink. like below.
https://docs.google.com/spreadsheets/d/<File_ID>/edit?usp=drivesdk
see screenshot-->: webViewlink
As you can see, the links are different from each other, and the problem is with non-Google domains
When I try to open the provided webViewlink in an incognito mode, it asks the following.
see screenshot-->: visitor session not recognized through webViewlink
On the other hand, the link included in the email will recognize that it is a non-Google domain and we will open a visitor session as well as send a code to verify it
see screenshot-->: verfication process
The question now is if there is a way to get this same link like the one in the email
Related
Any ideas on how to share a Google drive folder with an external visitor that does not have a Gmail address?
When creating link(Using UI) for external visitor(not a gmail or gdrive user) we get an option to notify user with a link(This is not the same link as share link).
The notification email contains a link where user visits and enters an
OTP to login which is emailed to external user by Google.
I need the external user to have writer access too. I can see here that it is possible via the UI however I cannot find any reference to this in the API documentation. I have successfully generated a share link using this documentation, but Google is requiring the user to log in, which is not what I want.
Our company has changed to a new google account due to rebranding. We've created new project, OAuth consent screen and a client. Since then, our users presented with, what I call, multiple consent screen. They have to click on every single permission popup separately and then submit the summary page This is annoying. Previously, there was one page with all the scopes/permissions on it only. Examples attached:
Before:
After:
Does anybody know what's going on and how to switch it back?
Thank you
There was an announcement from Google. It's the change they made.
https://developers.googleblog.com/2018/10/more-granular-google-account.html
We will show each permission that an app requests one at a time, within its own dialog, instead of presenting all permissions in a single dialog*. Users will have the ability to grant or deny permissions individually.
I have a newsletter powered by an laravel application. It lets subscribers select an area and set some filters to receive mail notifications on new housing for sale.
To solve this in an easy way for the user I did not want to use passwords and a long registration process with names etc. Instead, you just get an email, in that email there is an edit link with a secret token:
https://myapp.com/subscribers/42/edit?token=gwoi6n4ginagrpoargp4ar5gp14a
Would this be considered a safe approach?
When a user clicks the link, it is over HTTPS so it is encrypted, but it will still show in the current browsers history..
Will I get flamed for doing this and if so what are some ways to improve it?
with encrypted data in ssl communications yes it's safe. but in my opinion there is some offers:
1-remove token word from the address.
2- this link should not show the user edit page directly. instead sends arguments to a controller and controller redirects user to a new page with a clean link. just save token in the page for authorizing your user.
3- why not to produce longer (just a bit longer!) tokens?
4- for being safer each link should have an expire time. new link will be sent with each newsletter mail.
I am using Laravel 5.4 to make an in-house app that does not have any authentication (out of my control). A user submits information, and an email is sent to a manager with the info and they can either accept/reject it by clicking on a button. If they click on the accept button a new window opens up where they can do stuff like change the user submitted information.
A token is generated and sent in the email so when the manager presses the accept button the token is sent along in the URL. How can I verify that the token is valid (matches what is saved in the database) before allowing them to make any updates or changes? Is possible to block access to the route so they cant even open the webpage if the token is invalid?
I would also appreciate other ideas on how to best protect the app without using authentication
Is it possible for me to create an application that can send our requests to access to users' Google Calendar so that I can see the events in there and be able to add, edit, and delete events?
I do not want the users to log into my website to enable this access. Rather, I want to be able to send this request, perhaps via email.
Alternatively, perhaps they could log in the web app and authorize access themselves somehow.
One option would be to e-mail the user a link to the OAuth 2.0 consent screen. The users would still need to open the link in a browser, sign in to their Google account (if not already signed in), and click the "Authorize" button to grant your application access to their Google calendar events.
First, you will need to register your application as a Web App in Google's Developer Console (just like for any other application) and obtain a client_id. Be sure to fill in the name of your application and a link to your website in the "OAuth consent screen" section, because these values will be shown to your users when they click the authorization link.
Then, follow these steps:
Send the user an authorization link in an HTML e-mail message. The link should be constructed according to the guidelines in "Redirecting to Google's OAuth 2.0 server", and pay attention to the following aspects:
Ensure that the redirect_uri parameter in the authorization link points to your application.
Since you already know the e-mail address of the user, consider including the login_hint=<email address> parameter to bypass the account selection screen.
Important: provide a value in the state parameter so that you can link this authorization request with the user.
The link should be placed in an <a> tag somewhere in the body of the e-mail: Allow access to my Google calendar
When the user clicks on this link, their browser will open and show the standard Google consent screen:
Once the user has made a choice, their browser will be redirected to the redirect_uri which you have provided.
Make sure that the redirect_uri will work even if the user isn't signed in to your application. Capture the state and authorization_code values which Google appends to the redirect_uri, and then return a confirmation page (e.g. "Thank you for giving us access to your Google calendar" would be a good idea).
Using the state and authorization_code values, follow the rest of the standard OAuth 2.0 flow and retrieve a refresh_token which will allow you to access the user's Google calendar from your application.
Keep in mind that the calendar owner (the user who is clicking the link in the e-mail and granting your application consent to access the calendar) may not even be a user of your application. This is why it is important to provide as much information as possible on the consent screen and in the confirmation page.
Since your confirmation page will be loaded even if the user does not grant your application consent, you could take the opportunity to give the user a full description of why you are asking for access to their calendar and provide a link that will take them back to the consent screen. This should increase your success rate.
Every request your application sends to the Google Calendar API must
include an authorization token. The token also identifies your
application to Google.
Your application must use OAuth 2.0 to authorize requests. No other
authorization protocols are supported. If your application uses
Google+ Sign-In, some aspects of authorization are handled for you.
The details of the authorization process, or "flow," for OAuth 2.0
vary somewhat depending on what kind of application you're writing.
For more details on the workflow to gain access click here. Once your app has access, it will be able to view and edit a user's calendar events, depending on the approved permissions.