google / google/GoogleSignIn-iOS
iOS - Google Sign in - Revoked IDToken remains active until the token expire
- 主要语言
- Objective-C
- 星标
- 750
- 派生
- 282
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 9
描述
I'm using - GoogleSignIn (7.1.0) framework in my iOS application and I can see that the token seems valid until the expiration date is reached. I use the accepted approach as called has Previos Sign In and calling restorePrevios Sign in, but the received user object still contains the user's data. I have tried Apple and Facebook login, but both of them revoked the access as soon as the Application permission was revoked, only Google keep sending it.
The code snippet, I used:
(if GIDSignIn.sharedInstance.hasPreviousSignIn() {
GIDSignIn.sharedInstance.restorePreviousSignIn { user, error in)
}
})
I have also tried calling https://oauth2.googleapis.com/tokeninfo?id_token=\(idToken) which responded 200 after 15 minutes of the permission revoke, so it looks like the token is fully valid until the expiration data
It's important for us that the user can still access his account for some time and will be deleted in about 2 hours after the token creation, which is super annoying.
I have attached a screenshot about the GIDGoogleUser, which contains all the data, it was about 5 minutes after the permission revoke.

贡献指南
调研方向
首先检查 GoogleSignIn 7.1.0 中围绕 GIDSignIn.sharedInstance.hasPreviousSignIn() 和 restorePreviousSignIn 的行为,然后将其与撤销权限后的 tokeninfo endpoint 进行比较。重现报告的延迟,并确定 SDK 是否提供在 token 过期前检测撤销的受支持方式;当预期行为及其处理方式已记录,或已由经过验证的修复覆盖时,即视为完成。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- ios, swift
- 领域
- authentication, mobile-dev
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 32/100