主要的挂断是验证ID令牌段落的完整性.它概述了验证JWT的几个步骤,然后说明:
Rather than writing your own code to perform these verification steps,we strongly recommend using a Google API client library for your platform,or calling our
tokeninfo
validation endpoint.
我一直在使用tokeninfo端点进行调试,但文档说明:
[the
tokeninfo
endpoint] is suitable only for deployments with fewer than 100 monthly active users,as well as for debugging and informational purposes.…
Using one of the Google API Client Libraries is the recommended way to validate Google ID tokens in a production environment.
对于Java,Google API客户端库包含一个可以验证id令牌的GoogleIdTokenVerifier
对象.
对于Python,提供了verify_id_token
功能.
我已经搜索了Google Client API Ruby gem(目前处于alpha版)的文档以及google-auth-library-ruby gem,但未能找到相同的功能.
Ruby中有相同的这些吗?
更新:
似乎https://code.google.com/p/google-id-token/可能会这样做;但是,该项目自2014年以来尚未更新.
我正在寻找一个维护项目,最好直接从谷歌.
解决方法
看起来积极维护.