2

BACKGROUND INFO

I have developed an application in R through the shiny package, and deployed it online through the shinyapps.io service.

Among its different functions, the shiny app can send emails (through my personal Google Account) to users if the fill a form. The emails are sent through the functionalities of the gmailr package, and to make it work I had to follow the procedure on the Google Cloud Platform to create a JSON token, configure the OAuth consent screen, and store the credentials I obtain in a folder of my R project. All the steps to this process are reported at the end of this GitHub issue I opened a while ago.

THE PROBLEM

The JSON token I generated on the Google Cloud Platform expires after some days.

After googling around, I noticed that this can happen if my "Application", on Google Cloud, is still in the Testing phase. First question about this statement:

  • What does it mean when Google refers, on the OAuth screen, as an Application in Testing phase? My application is already online on shinyapps.io, it's already functioning, and when I create a new token it can also send emails correctly (for a while).

In addition, on the Google's OAuth consent screen, I now have the possibility to "publish" such application. If I do that, the status changes as In production, and this message is displayed. Other questions:

  • What does it mean that the application will be available to everyone with a Google account? My application deployed on shinyapps.io doesn't require any login or any other data from the users, then what is this app they're talking about?
  • What will happen to users that try to connect to my application?
  • Are my credentials, as for example the JSON file, safe?

I know that there might be a lot of confusion in this post, but I am relly not an expert in this field, and so I am worried to make some mistakes.

Thanks a lot for your help!

nd091680
  • 585
  • 4
  • 15

1 Answers1

1

The GMail API, OAuth and all, is typically meant to allow your app to send email on behalf of any user. It seems your use-case is a little different - you only ever need to connect one user: your own.

What does it mean when Google refers, on the OAuth screen, as an **Application in Testing phase? My application is already online on shinyapps.io, it's already functioning, and when I create a new token it can also send emails correctly (for a while).

I think you mostly answered this yourself in your further questions. Google thinks you're building an app that any GMail user can connect to, and so for security reasons, they want to differentiate between a test app and a production app. They don't necessarily know whether or not your app is published on shinyapps.io.

What does it mean that the application will be available to everyone with a Google account? My application deployed on shinyapps.io doesn't require any login or any other data from the users, then what is this app they're talking about?

I alluded to this earlier, but the GMail API is intended for apps that allow any GMail user to connect and manipulate their own email. Imagine a third-party email client, or similar. Again - Google's wording sounds a bit odd wrt your app since it doesn't fit that bill.

What will happen to users that try to connect to my application?

If you don't explicitly host your own server that implements OAuth with Google, then nobody can even try to connect. As long as you don't leak the shared secret from your Google Cloud Platform entry, you're safe.

Are my credentials, as for example the JSON file, safe?

Probably anyone with the JSON file can send email on your behalf. Marking your app as 'in production' will not change the security implications of your JSON file.

Unfortunately, Google has pretty tight security around their APIs nowadays. If you want to mark your app as "in production" you might open up a can of worms regarding "restricted scopes" (sending email counts as restricted). However, since you're using the JSON file instead full OAuth, I'm not sure if this applies to you. To my knowledge, you should be safe to try marking your app as "in production". Worst-case scenario, you might be able to weasel around the strict verification requirements by saying your app is "internal":

Internal Use: The app is used only by people in your Google Workspace or Cloud Identity organization. Note that your app will not be subject to the unverified app screen or the 100-user cap if it's marked as Internal.

Resonious
  • 98
  • 5
  • Hey @Resonious, thank you very much for taking the time to answer me. I have marked your response as correct since you have clarified almost all my doubts. I just have another question. If I have understood correctly, when the app is published by Google users can discover it, and also access the JSON file. However, the secret file I obtained after the configuration is stored securely in the shinyapps.io server. To send emails on my behalf, shouldn't they configure the JSON with their own email? – nd091680 Oct 14 '22 at 09:15
  • I may be wrong here but I don't think Google has any discovery channel for apps published via the cloud console. Do you have any links that suggest otherwise? – Resonious Oct 14 '22 at 10:25
  • No, not really. I was just guessing that based on your answer. If people cannot see this "App", I also think that my JSON file will not be "improperly used", right? – nd091680 Oct 14 '22 at 12:28
  • 1
    Yeah as long as regular users can't get ahold of your JSON file, you should be safe. – Resonious Oct 15 '22 at 02:48