Google Authentication with node.js and passport.js always returning 401 (Unauthorized)

Question

I'm trying to authenticate user by Google token sent from an Android app. I'm using node.js and passport.

var GoogleTokenStrategy = require('passport-google-id-token');
var passport = require('passport');
var User            = require('./models/usersModel.js');

module.exports = function(app) {

passport.use(new GoogleTokenStrategy({
        clientID: "here-is-my-client-id.apps.googleusercontent.com"
    },
    function(parsedToken, googleId, done) {

        User.findOrCreate({ googleId: googleId }, function (err, user) {
            if(err) {
                return done(err);
            }
            if(!user) {
                user = new User({
                    username: googleId
                });
                user.save(function(err) {
                   if(err) console.log(err);
                    return done(err, user);
                });
            } else {
                return done(err, user);
            }
        });
    }
));

app.post('/auth/google',
    passport.authenticate('google-id-token'),
    function (req, res) {
        res.send(req.user? 200 : 401);
    }
);
};

However, I only keep getting 401 response and "Unauthorized" message. I double-checked my clientID, I also used https://www.googleapis.com/oauth2/v3/tokeninfo?id_token to validate the generated token, and everything seems to be ok.

What is more, yesterday, when I did my first tests, it worked. Today, with a new token, it doesn't.

What am I missing here?

If you're using the implicit method, then I'd say you've likely hard coded an access_token somewhere. If you're not using the implicit method, then it could be your authorization code that was hard coded. — jonode

CorrieSparrow CorrieSparrow · Accepted Answer · 2016-02-15T15:48:12

Actually it was my mistake and the solution here was simple - the only thing I had to do was to set Content-Type header to application/json.

Different header or no header at all resulted in 401 response.

Google Authentication with node.js and passport.js always returning 401 (Unauthorized)

1 Answers