When I send mail then, it successfully sends the mail. But after a few days, it says 'invalid_grant'. Then when I again generate a new refresh token from https://developers.google.com/oauthplayground and use it, it works again. So what's the problem that access token doesn't work after few days.
const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID
const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET
const GOOGLE_REDIRECT_URI = process.env.GOOGLE_REDIRECT_URI
const GOOGLE_REFRESH_TOKEN = process.env.GOOGLE_REFRESH_TOKEN
const oAuth2Client = new google.auth.OAuth2(GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI)
oAuth2Client.setCredentials({refresh_token: GOOGLE_REFRESH_TOKEN})
export async function sendMail(payload: IMailDTO): Promise<SMTPTransport.SentMessageInfo>{
const data = MailDTO.receiver(payload)
const accessToken = await oAuth2Client.getAccessToken()
const transport = nodemailer.createTransport({
// #ts-ignore
service: 'gmail',
auth: {
type: 'OAUTH2',
user: 'user#gmail.com',
clientId: GOOGLE_CLIENT_ID,
clientSecret: GOOGLE_CLIENT_SECRET,
refreshToken: GOOGLE_REFRESH_TOKEN,
accessToken,
}
})
const mailOptions = {
from: 'no-reply <no-reply#gmail.com>',
to: data.to,
subject: data.subject,
text: data.text,
html: data.html
}
let result = await transport.sendMail(mailOptions)
if(!result){
throw new Error("Email not sent. Try again.")
}
return result
}
The issue is not with your access token the issue is with your refresh token.
The first is the OAuth Playground will automatically revoke refresh tokens after 24h. You can avoid this by specifying your own application OAuth credentials using the Configuration panel.
The second being that if you have supplied your own OAuth Credentials and your application is still in testing then it will expire after seven days.
A Google Cloud Platform project with an OAuth consent screen configured for an external user type and a publishing status of "Testing" is issued a refresh token expiring in 7 days.
To have a refresh token that will not expire you need to create it using your own credentials and make sure to set your application in production.
Related
Google shuts down "Less secure app" feature on their mail services last month. Because of this, I cannot just use Nodemailer by using email and password only. I am forced to setup Nodemailer with Google OAuth. But, the refresh token expires every week. What should I do?
Here's my transporter code.
const transporter = nodemailer.createTransport({
service: 'gmail',
auth: {
type: 'OAuth2',
user: process.env.GA_MAIL,
accessToken,
clientId: process.env.GA_CLIENT_ID,
clientSecret: process.env.GA_CLIENT_SECRET,
refreshToken: process.env.GA_REFRESH_TOKEN,
},
});
This is the problem better worded :
This is the file token.js :
const { google } = require('googleapis');
const path = require('path');
const fs = require('fs');
const credentials = require('./email.json');
// Replace with the code you received from Google
const code = "";
const { client_secret, client_id, redirect_uris } = credentials.installed;
const oAuth2Client = new google.auth.OAuth2(client_id, client_secret, redirect_uris[0]);
oAuth2Client.getToken(code).then(({ tokens }) => {
const tokenPath = path.join(__dirname, 'token.json');
fs.writeFileSync(tokenPath, JSON.stringify(tokens));
console.log('Access token and refresh token stored to token.json');
});
when running the token.js file a file called token.json gets created with some access tokens :
{"access_token":"","refresh_token":"","scope":"https://www.googleapis.com/auth/gmail.send","token_type":"Bearer","expiry_date":1656595108942}
but after 7 days the access_token expires.
A solution I came up with , though it's untested , is to have inside a .catch() block a call for a token refresh like so :
main.js :
//...
const refreshToken = require("./refresh_token.js");
//...
}).catch((err) => {
reply(interaction,"Error, Refreshing token.. Please try again");
console.error(err);
refreshToken();
return;
});
//...
refresh_token.js :
const { google } = require('googleapis');
const path = require('path');
const fs = require('fs');
const credentials = require('./email.json');
const token = require("./token.json");
module.exports = () => {
const code = token.refresh_token;
const { client_secret, client_id, redirect_uris } = credentials.installed;
const oAuth2Client = new google.auth.OAuth2(client_id, client_secret, redirect_uris[0]);
oAuth2Client.getToken(code).then(({ tokens }) => {
const tokenPath = path.join(__dirname, 'token.json');
fs.writeFileSync(tokenPath, JSON.stringify(tokens));
console.log('Access token and refresh token stored to token.json');
});
}
The reason I put it in a catch statement is because when the token is not expired we get a invalid_grant error when trying to run oAuth2Client.getToken(token.refresh_token)
^^ THIS HAS NOT BEEN TESTED ^^
if the refresh_token expires as well then I have no idea how to do this , please help
Setting the testing mode into a production mode in Google Developer Console will prevent refresh token from exipiring.
I have been using NextJS, Twitter-lite to build an application using the twitter app, I basically am trying to implement the functionality in which users can post a tweet from the app to their twitter accounts. I have also used Next-Auth for implementing oAuth for twitter.
So after some working, I have managed to make it work and highlight my error - Access tokens. I want to fetch access tokens from the user after they have logged in,
In the below example - I run this script and a post is updated to my account indeed
Here is my code for the api/twitter/post.js
import Twitter from 'twitter-lite';
import { getSession } from 'next-auth/react'
import { getToken } from 'next-auth/jwt';
export default async (req, res) =>{
var Twit = require('twit')
const session = await getSession({ req });
const token = await getToken({
req,
secret: process.env.NEXTAUTH_SECRET
});
console.log(token.twitter.accessToken)
var T = new Twit({
consumer_key: process.env.TWITTER_CONSUMER_KEY,
consumer_secret: process.env.TWITTER_CONSUMER_SECRET,
access_token: 'process.env.TWITTER_ACCESS_TKN',
access_token_secret: 'process.env.TWITTER_ACCESS_TKN_SCRT'
});
T.post('statuses/update', { status: 'hello worldj!' }, function(err, data, response) {
console.log(data)
})
return res.status(200).json({ status: 'ok'});
}
Now this does work, when I hit my api route a new tweet is posted but only to 'my' account because I provided my access_tokens, I would like to know how I can get users access tokens, I have already signed them in using NextAuth so I'm sure I'm just missing a few things.
So I figured this one out,
In the call backs functions in the [...nextauth].js, I was just fetching the access_tokens with an outdated name and the new name is account.oauth_token
For anyone who ever encounters this issue - (Trying to fetch logged in users access tokens to access restricted twitter endpoints)
callbacks: {
async jwt({ token, user, account = {}, profile, isNewUser }) {
if (account.provider && !token [account.provider]) {
token[account.provider] = {};
}
if(account.oauth_token) {
token[account.provider].accessToken = account.oauth_token;
}
if (account.oauth_token_secret) {
token [account.provider].refreshToken = account.oauth_token_secret;
}
return token
},
This is how you get the logged in users access_token and access_token_secret
I want to let my users send emails in my app through their Gmail account.
So, in my front-end, I'm collecting the token generated with
const provider = new firebase.auth.GoogleAuthProvider()
provider.addScope('https://www.googleapis.com/auth/gmail.send')
provider.setCustomParameters({
access_type: 'offline',
prompt: 'consent',
})
firebase.auth()
.signInWithPopup(provider)
.then((result) => {
var credential = result.credential;
var token = credential.accessToken;
})
In my backend, I'm using this token to send emails on their behalf thanks to the Google API. Eveything works well but the token only last one hour...
Do you have any recommandations about the right way to handle this ? Do I need to extend the duration of the token ? Do I have to create a new token every time I want to send an email ? Or do I have to not use firebase to collect the token ?
By default, Firebase auth returns a short-lived authentication token and a refresh token that you can use to extend that session indefinitely. In order to extend that session you'll need to implement session cookies.
Here's a brief summary of how it works:
User signs in using .signInWithPopup()
User POSTs that ID token to a backend API endpoint that calls .verifyIdToken() to validate the token and then .createSessionCookie() with whatever expiration you desire.
Backend reponds with a set-cookie HTTP parameter containing the generated session cookie.
Here's an example of what that backend API endpoint would look like:
login(req: any, res: Response) {
// Cookie has a 30 day expiration
const AUTH_COOKIE_LENGTH = 30;
// If no ID Token was passed, return an error
if (!req.body.idToken) {
return res.status(400).end();
}
// The ID Token passed as a POST parameter
const idToken = req.body.idToken.toString().trim();
// Verify the ID Token
admin.auth().verifyIdToken(idToken)
.then(async (user) => {
// Cookie expires
const expiresIn = 60 * 60 * 24 * AUTH_COOKIE_LENGTH * 1000;
// Generate the session cookie
admin.auth().createSessionCookie(idToken, {expiresIn})
.then((sessionCookie) => {
// Add the set-cookie parameter to the response
res.cookie("__session", sessionCookie, {
domain: '.example.com',
secure: true,
sameSite: 'strict',
expires: expiresIn
});
res.json({
success: true
}).end();
}, (error: any) => {
res.status(503).json({success: false}).end();
});
}).catch((error: any) => {
res.status(401).json({success: false, error: "INVALID_TOKEN"}).end();
});
}
I'm trying to use ably.io with Angular and Azure Functions using the JWT way of authenticating since it's secure, but I'm having issues with configuring the angular side of it. The use case is for a live auction site to update bids in realtime. There isn't a specific angular tutorial for this so I'm trying to piece it together. Also this code
realtime.connection.once('connected', function () {
console.log('Client connected to Ably using JWT')
alert("Client successfully connected Ably using JWT auth")
});
never throws the alert so I don't think it's working right. I used to have it working where I wasn't using ably JWT, but had the API key on the client-side in a component like this
let api = "<api key>";
let options: Ably.Types.ClientOptions = { key: api };
let client = new Ably.Realtime(options); /* inferred type Ably.Realtime */
let channel = client.channels.get(
"auctions"
);
and I could subscribe to that channel and update auctions accordingly by their id inside ngOnInit()
channel.subscribe(message => {
const auction = this.posts.find(action => {
return action.id === message.data.auctionId;
});
if (auction) {
auction.currentBid = message.data.lastBid;
}
});
but I need to switch this logic for JWT and somehow feed that JWT token into different components as well.
Ably.io JWT tutorial reference
I put the following in my angular login service
login(email: string, password: string) {
const authData: AuthDataLogin = { email: email, password: password };
return this.http
.post<{
token: string;
expiresIn: number;
userId: string;
}>(environment.azure_function_url + "/POST-Login", authData)
.pipe(takeUntil(this.destroy)).subscribe(response => {
//JWT login token. Not Ably JWT Token
const token = response.token;
this.token = token;
if (token) {
console.log('Fetching JWT token from auth server')
var realtime = new Ably.Realtime({
authUrl: "http://localhost:7071/api/AblyAuth"
});
realtime.connection.once('connected', function () {
console.log('Client connected to Ably using JWT')
alert("Client successfully connected Ably using JWT auth")
});
...
}
With my azure function already configured, When I login, the browser console outputs
GET wss://realtime.ably.io/?access_token=<token was here>&format=json&heartbeats=true&v=1.1&lib=js-web-1.1.22
SO it returns my token, but
the alert never happens
I'm not sure how to grab that JWT token that's returned to the browser. I was thinking I could store it in localStorage to share between components and clear out localStorage when user logs out, but I need to be able to subscribe to response and assign the token to a variable, but I didn't see in ably javascript tutorial how to get variable assigned to JWT Token response since it's being called with this syntax.
I appreciate any help with this!
var realtime = new Ably.Realtime({
authUrl: "http://localhost:7071/api/AblyAuth"
});
My azure function looks like
const checkAuth = require('../middleware/check-auth');
var jwt = require("jsonwebtoken")
var appId = '<APP ID>'
var keyId = '<key ID>'
var keySecret = '<key secret>'
var ttlSeconds = 60
var jwtPayload =
{
'x-ably-capability': JSON.stringify({ '*': ['publish', 'subscribe'] })
}
var jwtOptions =
{
expiresIn: ttlSeconds,
keyid: `${appId}.${keyId}`
}
console.log("JwtPayload");
console.log(jwtPayload);
console.log("jwtOptions");
console.log(jwtOptions);
module.exports = function (context, req) {
console.log("INSIDE ABLY AUTH")
// checkAuth(context, req);
console.log('Sucessfully connected to the server auth endpoint')
jwt.sign(jwtPayload, keySecret, jwtOptions, function (err, tokenId) {
if (err) {
console.log("ERR")
console.log(err)
console.trace()
return
}
context.res.header('Cache-Control', 'private, no-cache, no-store, must-revalidate')
context.res.setHeader('Content-Type', 'application/json')
console.log('Sending signed JWT token back to client')
console.log(tokenId)
context.res = {
status: 200,
body: JSON.stringify(tokenId),
headers: {
"Access-Control-Allow-Credentials": "true",
"Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Methods": "GET, OPTIONS",
"Access-Control-Allow-Headers": "Content-Type, Set-Cookie",
"Access-Control-Max-Age": "86400",
"Vary": "Accept-Encoding, Origin",
"Content-Type": "application/json"
}
};
context.done();
})
}
I'd recommend if you're wanting to intercept the JWT prior to passing it to Ably (so as to verify the contents, and also use the JWT for other components), you make use of authCallback instead of authUrl. You can use a function instead of a direct URL, within which you can call the endpoint, and do anything you like with the response, prior to passing the JWT back to the Ably constructor. I've made a JavaScript example of using the authCallback for normal Token Authentication, but the same principle applies.
As to why you're not seeing the alert, it looks like you're sending an invalid JWT for what Ably is expecting, and thus you're not successfully connecting to Ably. For example, you're specifying 'expiresIn' rather than 'exp'. For a token to be considered valid, it expected certain elements in a very specific structure, see the documentation. I'd recommend for this sort of situation where you're not certain what's breaking that you make use of verbose logging, which you can enable in the connection constructor as "log": 4.
I'm creating an application for YouTube that utilizes some of the Analytics APIs for Content Owners. The APIs require a user with sufficient permissions to be logged in, who can then retrieve reports for all the users of our application.
Currently our application can get YouTube User IDs, which is fine, but we need a separate account (other than the current user) to make requests to the API using the logged in user's ID.
How can I implement such a setup? I know it would involve using offline authentication and periodically refreshing the access tokens, but I'm not quite sure how to do it.
I've done a Google Analytics dashboard that refreshes the token in an interval. The admin chooses the GA Profile and it plots things. I needed to use a bunch of stuff to do that:
Npm Integration - So easy to use. Just take a look how to make methods calls sync.
google-api-nodejs-client [alpha] - Integrate it with the Npm above. It refreshes the token for you automatically when you Make Authenticated Requests
If you don't want to use google-apis-nodejs-client to refresh your token, you can use this code I've made to refresh the token by yourself:
var googleAccount = Accounts.loginServiceConfiguration.findOne({service: 'google'});
CLIENT_ID = googleAccount.clientId;
CLIENT_SECRET = googleAccount.secret;
REDIRECT_URL = '/_oauth/google?close';
var googleapis = Meteor.require('googleapis'),
OAuth2Client = googleapis.OAuth2Client,
client = getClient();
function getClient () {
var client = Meteor.sync(function (done) {
googleapis.discover('analytics', 'v3').execute(function (err, client) {
done(err, client);
});
});
if (client.err)
throw new Meteor.Error(400, 'Client not received');
return client.result;
}
function getOAuth2Client (user) {
var accessToken = user.services.google.accessToken,
refreshToken = user.services.google.refreshToken,
oauth2Client = new OAuth2Client(CLIENT_ID, CLIENT_SECRET, REDIRECT_URL);
if (user.services.google.expiresAt < +(new Date())) {
var res = Meteor.http.call("POST", "https://accounts.google.com/o/oauth2/token",
{params: {
grant_type : 'refresh_token',
refresh_token : refreshToken,
client_id : CLIENT_ID,
client_secret : CLIENT_SECRET
}, headers: {
"content-type": "application/x-www-form-urlencoded"
}});
accessToken = res.data.access_token;
Meteor.users.update({_id: user._id}, {$set: {
'services.google.accessToken': accessToken,
'services.google.expiresAt': +(new Date()) + (1000 * res.data.expires_in)
}});
}
oauth2Client.credentials = {
access_token: accessToken,
refresh_token: refreshToken
};
return oauth2Client;
}
Meteor.methods({
'getAccounts': function () {
var user = Meteor.users.findOne({_id: this.userId}),
oauth2Client = getOAuth2Client(user),
accounts = getAccounts(oauth2Client, client);
return accounts;
}
});