If I am currently on my computer logged in via gmail and then login via your application, your app makes the connection between my gmail account and the account of your website.
If I logout, only my session on your website is destroyed and I am logged out from your website. This has no impact on my logged in status on gmail. If I visit the gmail website now, I will still be logged in via my gmail account. Therefore, if I again visit your website and login via gmail, I will be logged in with my associated account.
So if another person wants to login, I first have to go to gmail and logout. The other person has to login on gmail and can then login on your website with his gmail credentials.
How to solve this ? So that logout works for both gmail and my site.
Related
I have developed an app that is using Auth APIs of Facebook and Gmail. as you know we don't need any email password to login just click on facebook or gmail button and auth API generates authentication token to login into app.
So I am submitting that app on playstore but they are rejecting and asking for login credentials. I have provided them my gmail account login credentials but they using those credentials to login into facebook account and rejected my app again.
what I should do to avoid rejection again?
I have created a facebook developer account but i am able to login through my account that i habve created on facebook if i login with other user i'm not able to login. Is there any settings in facebook developer console.
Any solution please
In my web app, I'm integrating a "Sign In With Google" button with Google Api Client (JS), in order to then integrate with some other Google services.
So far I've already implemented the login logic: the user is able to click the button and proceed to the application, the flow is this:
the user accepts to connect the app to its google account
then I send the response token to my backend (PHP) to check the token and store in the DB the Google UserID (sud)
If the user had already an account with my app, I update the profile to add the google sign in option.
If the user did not have an account I ask him to register client side.
from now on the user can access my app both with my app's login credentials, and with "Google Sign In".
I send back to the client the access authorization to my app.
My problem is, how to sign in the user automatically the next time? At least two scenarios my happen:
the user opens my app from the computer of a friend in which another google account is already logged in. The user chooses to login in my app with my app's credentials (not "Google Sign In"), so once he/she is logged in, by refreshing the token I would get the wrong Google account. Displaying the authorization window again wouldn't be ideal and would surely offset the user seeing someone else's account.
the user opens my app in incognito (private) mode on a friends' computer, and he/she chooses to login using his/her email and password, not the google sign in. Again, I wouldn't know how to re-sign in the user with the google api client.
Since I know in my backend what Google user is "my user", is there a way to pass such information to the google client api, so that it logs in the right user?
I am reading the docs in the Stormpath website. They have documentation about how to create account, application...
But I cannot find the overview the big picture of the Stormpath
especially how can my web application can integrate with it.
I need a picture that describe the flow of the authentication between my Web Server, browser, and stormpath API.
I have a web application and a login page.
My specific questions are:
When a user clicks the submit button of the login page, should I call the RestAPI to Stormpath to authenticate or I need to send username and password to my web server, and web server will send it to Stormpath to authenticate?
If when a user clicks the submit button and I need to call the RestAPI of Stormpath from JavaScript, after login successfully do I have a returned Access token? And what can I do with that token.
Please help me.
Heyo -- I work at Stormpath, so hopefully I can explain this for you a bit.
If you're building a website, and storing your users with Stormpath, here's how authentication works:
A user visits your website, and clicks the login page.
You show a login page and collect the user's email and password (or username).
The user clicks Login, and that form data is transferred to your web server (not Stormpath!).
On your server-side code, you would then use one of the Stormpath libraries to authenticate the user's account. You would take the form data the user submitted to your server, and then call the proper Stormpath method to authenticate the user.
Stormpath will log this user in, by creating an access and refresh token, and securely storing cookies for your user in the browser.
This is how the flow typically works.
I have an Web application that uses Google Drive. In order to make it easier for user to integrate his account (in this web application will be easier for client this way), I would like to have two links for authentication:
A link with the current user email that sends the user to the authorization page.
A link that automatically logout the current user from Google (if any) and send the user to authorization page (in this case the login page).
In order to accomplish that I need:
- the current Google user email
- logout current Google user
I really think this is not possible, but is it possible to me do this actions before have my application authorized by user?
You will only be able to pull a user's email address after they have authorized you to do so, so that isn't possible.
You can use OpenID to retrieve a user's email address or redirect them to the Google login page if they aren't logged in. They have to authorize your application, though, so you won't be able to direct them to different places until after they've signed in. There are details on the login flow at https://developers.google.com/accounts/docs/OpenID#Interaction.