3. Authentication
We use authentication via Google Cloud Identity Platform that allows us to easily facilitate user authentication through JSON web tokens (JWT).
This platform provides plugins that manage login with external services. It uses OAuth 2.0 for GitHub and Google, and SAML for Georgia Tech. Our integration with Georgia Tech SSO is a special case that involved setting up configuration through GT OIT. It also provides tools for email & passcode login and works directly with Firebase to provide tools like password reset and email verification.
When you login on our login website, Google Cloud handles all the verification and retrieves an idToken. Then, the frontend makes a request to our API auth service which creates a session cookie from your idToken. This cookie is then set for all hexlabs.org subdomains which allows us to share authentication through all of our different frontends. Google Cloud Identity Platform does provide built-in persistence for user sessions, but we've found using session cookies is the best way that works well with our backend platform.
There are two ways services can authenticate a user. The first way is by reading and decoding the session cookie on the request. The other way is by reading and decoding the Authorization header on the request to verify the sent token.
When doing development/testing, the easiest way is to manually set your Authorization header on your HTTP request using a Bearer token (essentially just an access token). You can retrieve an access token for a user by following these steps:
- Visit login.hexlabs.org and open the developer tools.
- After logging in, you will see your user profile printed in the console tab as
e. - Your access token can be found under the
accessTokenfield. Make sure you copy the entire string, it's pretty long. You can also see your global userId under theuidfield.
Note that these tokens expire very quickly after an hour, so you will often have to retrieve a new token if you receive an unauthenticated error.
We recommend using Postman for local development. Thus, you would set your authentication to Bearer [accessToken]:
- Select the "Authorization" Tab
- Select "Bearer Token" from the type dropdown
- Enter your token in the field
