googleapis / googleapis/google-cloud-node

Slow response times when obtaining Domain Wide Delegation token and during inbound Authorization header validation

Open
#7,721 4 comments 0 reactions 1 assignee Assigned to @d-goog View on GitHub
library: google-cloud-node-core priority: p3 status: blocked type: bug
Dominant language
TypeScript
Stars
3.2k
Forks
712
Avg merge
2d 3h
Merged PRs (30d)
99

Description

#### Environment details

- OS: Linux
- Node.js version: v16.20.2
- npm version: 8.19.4
- `google-auth-library` version: 8.19.4

#### Obtaining an Domain Wide Delegated Access Token

We have two issues when using the client library when trying to PATCH a subscription. When patching a subscription for a Chat Space we are obtaining a users Domain Wide Delegated token to use as the Authorization header for the PATCH operation.

We are using the `GoogleAuth` client to obtain the token and during the call to `getAccessToken();` it makes a request to the Google endpoint [https://www.googleapis.com/oauth2/v4/token](https://www.googleapis.com/oauth2/v4/token)

We have been experiencing slow response times when hitting this endpoint as show in the attachments.

![image](https://github.com/googleapis/google-cloud-node/assets/11923774/861478f4-9629-46e0-ab2e-65b5f75bccc2)

```
const auth = new GoogleAuth({
"https://www.googleapis.com/auth/chat.memberships https://www.googleapis.com/auth/chat.memberships.app https://www.googleapis.com/auth/chat.messages https://www.googleapis.com/auth/chat.spaces https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile",
clientOptions: { subject: [EMAIL] },
credentials: [GOOGLE_APP_CREDENTIALS],
});

const client = await auth.getClient();

const jwtResponse: GetAccessTokenResponse = await client.getAccessToken();

return jwtResponse.token!;
```

##### Header Authorization

We have also noticed slow response times during validation of the [JWT Authorization](https://cloud.google.com/pubsub/docs/push?&_ga=2.161091066.-658722833.1697454650#authentication) header that is sent as part of the push notification. In the library it makes a call to [https://www.googleapis.com/oauth2/v1/certs](https://www.googleapis.com/oauth2/v1/certs). Occasionally we have seen slow response times from this request as show in the attachments.

![image](https://github.com/googleapis/google-cloud-node/assets/11923774/d73c6e06-9a48-4689-a981-f03395af7f50)

```
const bearerTokenHeader = req.header('Authorization');

const token = bearerTokenHeader.match(/Bearer (.*)/);

const idToken = token[1];

const client = new OAuth2Client();

const ticket = await client.verifyIdToken({ idToken });

const claim = ticket.getPayload();
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.