3

Question: What is the difference between the following OAuth 2.0 authorization URLs:

In various documents example I see reference to this authorization URL:

https://accounts.google.com/o/oauth2/auth

In other documents example I see reference to this authorization URL:

https://accounts.google.com/o/oauth2/v2/auth

These URLs are used for code like this (Python):

authorization_base_url is one of the above URLs.

authorization_url, state = gcp.authorization_url(
                            authorization_base_url,
                            access_type="offline",
                            prompt="select_account",
                            include_granted_scopes='true')

I am in the process of debugging another Google OAuth 2.0 Refresh Token problem and I am trying to clarify the exact solution link. I am seeing behaviour that does not match documentation.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • If you want the most updated one you should check https://accounts.google.com/.well-known/openid-configuration however. The one in that does not work with all the client libraries in my experience. I sent an email off to the Google Oauth team with luck they will respond to your question. – Linda Lawton - DaImTo Nov 19 '18 at 08:39
  • @DaImTo - Thank you. Also mention to the Google team that they should add `https://www.googleapis.com/oauth2/v3/tokeninfo` to `openid-configuration`. I am curious why that endpoint is left out of that document. – John Hanley Nov 19 '18 at 14:42
  • I emailed them about this a few months ago when the added the one thats in the discovery doc now. I have yet to get a concrete answer back – Linda Lawton - DaImTo Nov 19 '18 at 14:58

1 Answers1

1

There's no documentation of the differences but in general they are different versions of the same endpoint.

A newer version may introduce improved or changed behavior though protocol-wise and interoperability-wise there should be no difference to the consumer. They're all OAuth 2.0/OIDC compliant but within the spec there are different optional behaviours that may be implemented.

As an example of that: when an error occurs on the Google side, Google may decide to stop the flow and show this error to the user, or alternatively return an error to the Client as OAuth 2.0 allows you to do. Both are valid behaviors and different versions of the Authorization endpoint may implement a different flavor.

Hans Z.
  • 50,496
  • 12
  • 102
  • 115
  • Thank you. It is the exact behaviour that I am having trouble with. In the other question that I referenced, I am receiving a Refresh Token for my implementation in localhost mode. When I deployed to a public server, I stopped receiving Refresh Tokens. I am now looking for details to figure this out. – John Hanley Nov 19 '18 at 14:38
  • I think that's two questions – Hans Z. Nov 19 '18 at 15:02