Authentication on Android and web.
WHAT IT PROVIDES
Users signing in with an account they already have.
WHY THAT MATTERS
It removes password creation, which is a common point of abandonment.
WHAT IT RETURNS
A token proving identity.
WHAT TO DO WITH IT
Send it to your server, and verify it there.
WHAT VERIFICATION MEANS
Checking the signature, the audience and the expiry, against the provider.
WHAT TO NEVER DO
Trust a token without verifying it Trust an identifier sent by the client without a verified token
WHY
Anything the client sends can be fabricated.
WHAT TO USE FOR ACCESSING USER DATA
A separate authorisation step, requesting specific scopes.
WHY SEPARATE
Signing in and accessing data are different things, and combining them requests more than needed at the wrong moment.
WHAT TO REQUEST
Only the scopes the feature requires, when it is used.
WHAT TO HANDLE
Refusal Revocation later Accounts removed from the device
WHAT TO CONSIDER
Offering more than one sign-in option.
WHY
Not everyone has, or wants to use, one particular account.
