Google auth fails

[lboff]

I am trying to use Google login, and I am having issues...

The Home page has a "Sign in with Google" (href to http://localhost:8080/auth/google/login\n?site=auth-demo\n&from=http://localhost:8080/private) then I have a call to google https://accounts.google.com/o/oauth2/auth.... instead of https://accounts.google.com/o/oauth2/v2/auth....

I can authenticate with google, I get the call back, I can read the Coockies and the JWT but the token.GetUserInfo(r) fails
If I use the Auth Middleware (m.Auth) instead of m.Trace) the Middleware fails with Unauthorized.

Is this a bug? Is this a bad configuration? In the official example there is nothing about google.

package main

import (
	"fmt"
	"log"
	"net/http"
	"net/url"
	"os"
	"time"

	"github.com/go-chi/chi/v5"
	"github.com/go-pkgz/auth/v2"
	"github.com/go-pkgz/auth/v2/avatar"
	"github.com/go-pkgz/auth/v2/token"
)

func main() {
	baseURL := getenv("BASE_URL", "http://localhost:8080")
	siteID := getenv("SITE_ID", "auth-demo")

	// Optimized auth service configuration for Google OAuth
	opts := auth.Opts{
		URL:             baseURL,
		Issuer:          "auth-demo",
		TokenDuration:   24 * time.Hour, // Shorter token duration for security
		CookieDuration:  24 * time.Hour, // Match token duration
		JWTCookieName:   "JWT",          // Explicit cookie name
		JWTCookieDomain: "",             // Allow all domains for localhost
		JWTQuery:        "token",        // Allow JWT in query params
		SecretReader: token.SecretFunc(func(aud string) (string, error) {
			// Accept any audience for Google OAuth
			return getenv("JWT_SECRET", "dev-secret"), nil
		}),
		AvatarStore: avatar.NewNoOp(),
		// SecureCookies: false,              // Set to true in production with HTTPS
		// SameSite: http.SameSiteDefaultMode, // CSRF protection
	}

	service := auth.NewService(opts)

	// Use AddProvider - the simpler approach (Is this correct????)
	service.AddProvider("google", os.Getenv("GOOGLE_CLIENT_ID"), os.Getenv("GOOGLE_CLIENT_SECRET"))

	m := service.Middleware()
	authH, avatarH := service.Handlers()

	r := chi.NewRouter()
	r.Mount("/auth", authH)
	r.Mount("/avatar", avatarH)

	// Home page
	r.Get("/", func(w http.ResponseWriter, r *http.Request) {
		to := baseURL + "/private"
		loginURL := fmt.Sprintf("/auth/google/login?site=%s&from=%s",
			url.QueryEscape(siteID), url.QueryEscape(to))
		fmt.Fprintf(w, `<h1>Home</h1>
<p><a href="%s">Sign in with Google</a></p>
<p><a href="/auth/logout">Logout</a></p>`, loginURL)
	})

	// Protected page using go-pkgz/auth middleware
	r.With(m.Trace).Get("/private", func(w http.ResponseWriter, r *http.Request) {
		log.Printf("Cookies %s", r.Cookies())
		log.Printf("Context %s", r.Context())
		jwt := ""
		for _, cookie := range r.Cookies() {
			log.Printf("Cookie %s: %s", cookie.Name, cookie.Value)
			if cookie.Name == "JWT" {
				jwt = cookie.Value
			}
		}
		log.Printf("JWT: %s", jwt)

		user, err := token.GetUserInfo(r)
		if err != nil {
			http.Error(w, "Unauthorized: "+err.Error(), http.StatusUnauthorized)
			return
		}
		fmt.Fprintf(w, "Hello, %s (id: %s)\n", user.Name, user.ID)
	})

	log.Printf("Starting server on %s", baseURL)
	log.Fatal(http.ListenAndServe(":8080", r))
}

func getenv(k, def string) string {
	if v := os.Getenv(k); v != "" {
		return v
	}
	return def
}

[umputun]

Likely something with the configuration on your side. I can see the demo site for a project using this library works just fine with Google Auth https://remark42.com/demo/

moving to discussions

[lboff]

I have been able to log in with Google. It was an issue in my code. Now the point is that in the JWT I do not have the email. ```

"userInfo": {
    "name": "Lorenzo Boffelli",
    "id": "google_56xxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "picture": "http://localhost:8080/avatar/903d8b78a4252fcfd352f785a711380ebacb1bf4.image",
...
}

How can I get the authenticated user's email?