iKumeed
Back to Help Center

Google OAuth Security Guide

How Ikumeed secures Google sign-in and what admins should verify before going live.

State + Nonce

Prevents CSRF and replay attacks in OAuth/OIDC.

PKCE (S256)

Protects authorization code exchange from interception.

ID Token Verification

Verifies signature, issuer, audience, nonce, and email status.

What Is Enforced

  • Google OAuth uses a signed OIDC id_token for identity.
  • OAuth state is generated server-side and must match callback state.
  • OIDC nonce is generated server-side and must match token nonce claim.
  • PKCE code_verifier and code_challenge (S256) are required in flow.
  • id_token is verified against Google JWKS before account login/linking.
  • Only verified Google emails are accepted for sign-in.
  • Application auth tokens are set in HttpOnly cookies.

Admin Security Checklist

  1. Use HTTPS-only production callback URLs in Google Cloud Console.
  2. Set exact Authorized redirect URIs (no wildcards in production).
  3. Store GOOGLE_CLIENT_SECRET only in secure server settings.
  4. Rotate OAuth client secret if exposed or suspected compromised.
  5. Keep OAuth scopes minimal: openid, email, profile.
  6. Review failed OAuth callback logs for repeated state/nonce errors.
  7. Ensure JWT secrets are long random strings in production.

Important

If callback errors mention state, nonce, or code_verifier mismatch, clear browser cookies and retry. Persistent failures usually indicate redirect URL mismatch between app settings and Google Cloud Console.