An example of using OpenID for flags

Question

With the upcoming disabling of Google OpenID 2 support, any user using a convenient library, such as Flask-Googleauth , will have to migrate. There is a flag library for OpenID Connect called flask-oidc . Unfortunately, there is no information on how to use it. I searched for SO questions with flask and openid-connect tags, but found zero, hence this question.

Here's what I put together as an evidence-based concept for using an egg flask. It is based on the app.py check-oidc file :

 """ Flask app for testing the OpenID Connect extension. """ from flask import Flask from flask.ext.oidc import OpenIDConnect def index(): return "too many secrets", 200, { 'Content-Type': 'text/plain; charset=utf-8' } def create_app(config, oidc_overrides=None): app = Flask(__name__) app.config.update(config) if oidc_overrides is None: oidc_overrides = {} oidc = OpenIDConnect(app, **oidc_overrides) app.route('/')(oidc.check(index)) return app if __name__ == '__main__': APP = create_app({ 'OIDC_CLIENT_SECRETS': './client_secrets.json', 'SECRET_KEY': 'secret'}) APP.run(host="127.0.0.1", port=8080, debug=True) 

After registering my application, as described here , it successfully sends the user to Google for authentication and returns them to http://127.0.0.1:8080/oidc_callback , which then redirects them to https://127.0.0.1:8080/ , but then redirects the user back to Google for authentication, creating a redirect cycle.

My question, of course, is simple: how can I get an authenticated user to view this index page?

Answer 1

The problem is that oidc_callback correctly creates an authentication cookie (called oidc_id_token ) and is redirected to index , but index cannot receive this cookie because the application is hosted on HTTP and the cookie has a Protected flag set, therefore the browser does not want send it back to the application via HTTP.

Solution (for local development purposes only!) To disable the security flag by setting the OpenIDConnect OIDC_ID_TOKEN_COOKIE_SECURE configuration OIDC_ID_TOKEN_COOKIE_SECURE to False :

 if __name__ == '__main__': APP = create_app({ 'OIDC_CLIENT_SECRETS': './client_secrets.json', 'OIDC_ID_TOKEN_COOKIE_SECURE': False, 'SECRET_KEY': 'secret'}) APP.run(host="127.0.0.1", port=8080, debug=True)