zquestz/omniauth-google-oauth2 — pull request #50 by legendetm (2013-04-14 13:58:20+00:00)
Title: Hybrid client-server authentication

With the gem's current version you cannot make a hybrid client-server authentication, and the gem always tries to get access_token from the Google server by authorization_code. And because authorization_code and access_token must be queried with the same redirect_uri parameter, it fails.

After 2 days of googling around I found a way to verify access_token by id_token with an extra query https://www.googleapis.com/oauth2/v2/tokeninfo which takes two parameters id_token and access_token and returns the result if the parameters are valid.

Example of javascript code:
``` javascript
jQuery(function() {
return $.ajax({
url: 'https://apis.google.com/js/client:plus.js?onload=gpAsyncInit',
dataType: 'script',
cache: true
});
});

window.gpAsyncInit = function() {
$('.googleplus-login').click(function(e) {
e.preventDefault();
gapi.auth.authorize({
immediate: true,
response_type: 'id_token token',
cookie_policy: 'single_host_origin',
client_id: '000000000000.apps.googleusercontent.com',
scope: 'https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile'
}, function(response) {
if (response && !response.error) {
// google authentication succeed, now post data to server and handle data securly
jQuery.ajax({type: 'POST', url: "/auth/google_oauth2/callback", dataType: 'json', data: response,
success: function(json) {
// response from server
});
} else {
// google authentication failed
}
});
});
};
```