Google Login

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            # Not needed, because these are the defaults for the google registration:
            #   scope: openid, profile, email
            #   redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"

# Behind a reverse proxy or load balancer terminating TLS, tell Spring to trust the
# X-Forwarded-* headers. Otherwise {baseUrl} resolves to http://... and Google
# rejects the redirect with redirect_uri_mismatch.
server:
  forward-headers-strategy: framework

public record GoogleProfile(
        String sub,
        String email,
        boolean emailVerified,
        String name,
        String pictureUrl,
        String hostedDomain) {

    // From the redirect (oauth2Login) flow:
    public static GoogleProfile from(OidcUser user) {
        return new GoogleProfile(
            user.getSubject(),
            user.getEmail(),
            Boolean.TRUE.equals(user.getEmailVerified()),
            user.getFullName(),
            user.getPicture(),
            user.getClaimAsString("hd"));
    }

    // From the One Tap flow (verified payload, see the last sections):
    public static GoogleProfile from(GoogleIdToken.Payload p) {
        return new GoogleProfile(
            p.getSubject(),
            p.getEmail(),
            Boolean.TRUE.equals(p.getEmailVerified()),
            (String) p.get("name"),
            (String) p.get("picture"),
            p.getHostedDomain());
    }
}

// What Google sends (OidcUser accessors in brackets):
//   sub            stable, unique id for the account            [getSubject()]
//   email          the address, can change over time            [getEmail()]
//   email_verified true for virtually all Google accounts       [getEmailVerified()]
//   name           display name, may be absent                  [getFullName()]
//   given_name / family_name                                    [getGivenName() / getFamilyName()]
//   picture        URL on googleusercontent.com, may be absent  [getPicture()]
//   locale         e.g. "en"                                    [getLocale()]
//   hd             hosted domain, Workspace accounts only       [getClaimAsString("hd")]
//   iss, aud, iat, exp                                          validated for you by Spring Security

@Entity
@Table(name = "social_accounts",
       uniqueConstraints = @UniqueConstraint(columnNames = {"provider", "provider_id"}))
public class SocialAccount {
    @Id @GeneratedValue(strategy = GenerationType.SEQUENCE)
    private Long id;

    @Column(nullable = false) private String provider;                     // "google"
    @Column(name = "provider_id", nullable = false) private String providerId;   // the sub claim

    @ManyToOne(fetch = FetchType.LAZY, optional = false)
    private AppUser user;

    protected SocialAccount() { }
    public SocialAccount(String provider, String providerId, AppUser user) {
        this.provider = provider; this.providerId = providerId; this.user = user;
    }
    public AppUser getUser() { return user; }
}

@Service
public class GoogleAccountService {

    private final AppUserRepository users;
    private final SocialAccountRepository socialAccounts;

    public GoogleAccountService(AppUserRepository users, SocialAccountRepository socialAccounts) {
        this.users = users;
        this.socialAccounts = socialAccounts;
    }

    @Transactional
    public AppUser findOrCreate(GoogleProfile profile) {
        AppUser user = socialAccounts.findByProviderAndProviderId("google", profile.sub())
            .map(SocialAccount::getUser)
            .orElseGet(() -> createOrLink(profile));

        // Managed entity: this is written on commit, no save() needed.
        if (profile.pictureUrl() != null) {
            user.setPictureUrl(profile.pictureUrl());
        }
        return user;
    }

    private AppUser createOrLink(GoogleProfile profile) {
        AppUser user = users.findByEmailIgnoreCase(profile.email())
            .map(existing -> {
                if (!existing.isEmailVerified()) {
                    // Never merge into an account whose email nobody has proven ownership of.
                    throw new AccountConflictException(
                        "An account with this email exists. Sign in with your password, then link Google.");
                }
                return existing;
            })
            .orElseGet(() -> users.save(AppUser.newSocialUser(
                profile.email(), profile.name(), profile.pictureUrl())));   // verified, role USER

        socialAccounts.save(new SocialAccount("google", profile.sub(), user));
        return user;
    }
}

public class AppOidcUser extends DefaultOidcUser {

    private final Long userId;

    public AppOidcUser(Long userId, Collection<? extends GrantedAuthority> authorities,
                       OidcIdToken idToken, OidcUserInfo userInfo) {
        super(authorities, idToken, userInfo, "sub");   // name attribute = sub
        this.userId = userId;
    }

    public Long getUserId() { return userId; }
}

@Service
public class GoogleOidcUserService extends OidcUserService {

    private final GoogleAccountService accounts;

    @Value("${app.google.allowed-domain:}")   // empty means any Google account
    private String allowedDomain;

    public GoogleOidcUserService(GoogleAccountService accounts) {
        this.accounts = accounts;
    }

    @Override
    public OidcUser loadUser(OidcUserRequest request) throws OAuth2AuthenticationException {
        OidcUser google = super.loadUser(request);   // token already validated by Spring

        GoogleProfile profile = GoogleProfile.from(google);

        if (!profile.emailVerified()) {
            throw new OAuth2AuthenticationException(
                new OAuth2Error("email_not_verified"), "Google email is not verified");
        }
        // The hd parameter sent to Google is only a UI hint. This server-side check is the real restriction.
        if (!allowedDomain.isBlank() && !allowedDomain.equals(profile.hostedDomain())) {
            throw new OAuth2AuthenticationException(
                new OAuth2Error("domain_not_allowed"), "Sign-in is limited to " + allowedDomain);
        }

        AppUser user;
        try {
            user = accounts.findOrCreate(profile);
        } catch (AccountConflictException ex) {
            throw new OAuth2AuthenticationException(
                new OAuth2Error("account_conflict"), ex.getMessage(), ex);
        }

        List<GrantedAuthority> authorities = user.getRoles().stream()
            .<GrantedAuthority>map(r -> new SimpleGrantedAuthority("ROLE_" + r))
            .toList();

        return new AppOidcUser(user.getId(), authorities, google.getIdToken(), google.getUserInfo());
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http,
                                    GoogleOidcUserService oidcUserService,
                                    OAuth2AuthorizationRequestResolver requestResolver) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/", "/error", "/login/**").permitAll()
                .anyRequest().authenticated())
            .oauth2Login(oauth2 -> oauth2
                .authorizationEndpoint(ep -> ep.authorizationRequestResolver(requestResolver))
                .userInfoEndpoint(ep -> ep.oidcUserService(oidcUserService)))
            .logout(logout -> logout.logoutSuccessUrl("/"));
        return http.build();
    }
}

// In a controller, the logged-in user is injected like this:
//   @GetMapping("/me")
//   String me(@AuthenticationPrincipal AppOidcUser user) { return "user " + user.getUserId(); }

@Bean
OAuth2AuthorizationRequestResolver authorizationRequestResolver(
        ClientRegistrationRepository clientRegistrations) {

    var resolver = new DefaultOAuth2AuthorizationRequestResolver(
        clientRegistrations, "/oauth2/authorization");

    resolver.setAuthorizationRequestCustomizer(customizer -> customizer
        .additionalParameters(params -> {
            params.put("prompt", "select_account");   // always show the account chooser
            // params.put("hd", "example.com");       // UI hint only: still check the claim server-side
        }));

    return resolver;
}

<!-- Avatar: no-referrer avoids most hotlinking failures; a size suffix avoids huge downloads. -->
<img src="https://lh3.googleusercontent.com/a/ACg8oc...=s96-c"
     referrerpolicy="no-referrer"
     width="48" height="48"
     alt=""
     loading="lazy">

<!-- Thymeleaf, with a fallback when the user has no picture: -->
<img th:if="${user.pictureUrl != null}" th:src="${user.pictureUrl}"
     referrerpolicy="no-referrer" width="48" height="48" alt="">
<span th:unless="${user.pictureUrl != null}" th:text="${#strings.substring(user.name, 0, 1)}"></span>

// pom.xml:
//   <dependency>
//       <groupId>com.google.api-client</groupId>
//       <artifactId>google-api-client</artifactId>
//   </dependency>

@Component
public class GoogleTokenVerifier {

    private final GoogleIdTokenVerifier verifier;

    public GoogleTokenVerifier(@Value("${GOOGLE_CLIENT_ID}") String clientId) {
        this.verifier = new GoogleIdTokenVerifier.Builder(
                new NetHttpTransport(), GsonFactory.getDefaultInstance())
            .setAudience(List.of(clientId))   // reject tokens issued for any other app
            .build();
    }

    public GoogleIdToken.Payload verify(String credential) {
        try {
            GoogleIdToken token = verifier.verify(credential);   // signature, issuer, expiry, audience
            if (token == null) {
                throw new BadCredentialsException("Invalid Google credential");
            }
            return token.getPayload();
        } catch (GeneralSecurityException | IOException ex) {
            throw new AuthenticationServiceException("Could not verify Google credential", ex);
        }
    }
}

@RestController
@RequestMapping("/api/v1/auth/google")
public class GoogleAuthController {

    public record OneTapRequest(@NotBlank String credential) { }

    private final GoogleTokenVerifier verifier;
    private final GoogleAccountService accounts;
    private final JwtService jwtService;   // your own token issuer

    public GoogleAuthController(GoogleTokenVerifier verifier, GoogleAccountService accounts,
                                JwtService jwtService) {
        this.verifier = verifier;
        this.accounts = accounts;
        this.jwtService = jwtService;
    }

    @PostMapping("/one-tap")
    public ResponseEntity<AuthResponse> oneTap(@RequestBody @Valid OneTapRequest request) {
        GoogleProfile profile = GoogleProfile.from(verifier.verify(request.credential()));

        if (!profile.emailVerified()) {
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
        }

        AppUser user = accounts.findOrCreate(profile);   // same logic as the redirect flow
        return ResponseEntity.ok(jwtService.issueTokens(user));
    }
}

// If the browser POSTs the credential to your server through a redirect (data-login_uri) instead of a
// JavaScript callback, Google also sends a g_csrf_token cookie and body field. Compare them before
// verifying the credential.

logging:
  level:
    org.springframework.security: DEBUG
    org.springframework.security.oauth2: TRACE   # shows the token exchange and validation errors