Does OAuth always use the HTTP Authorization header?











up vote
1
down vote

favorite
1












Have an app running in GCP using App Engine and secured by IAP. To the best of my knowledge IAP uses OAuth, but when I open the app in the browser and inspect the outgoing XHR requests I don't see the HTTP Authorization header on any of them. There does appear to be a token in the cookies though, something named GCP_IAAP_AUTH_TOKEN.
Just wondering if this is still considered OAuth or is it some other form of authentication?






oauth google-cloud-platform







share|improve this question


























    up vote
    1
    down vote

    favorite
    1












    Have an app running in GCP using App Engine and secured by IAP. To the best of my knowledge IAP uses OAuth, but when I open the app in the browser and inspect the outgoing XHR requests I don't see the HTTP Authorization header on any of them. There does appear to be a token in the cookies though, something named GCP_IAAP_AUTH_TOKEN.
    Just wondering if this is still considered OAuth or is it some other form of authentication?






    oauth google-cloud-platform







    share|improve this question
























      up vote
      1
      down vote

      favorite
      1









      up vote
      1
      down vote

      favorite
      1






      1





      Have an app running in GCP using App Engine and secured by IAP. To the best of my knowledge IAP uses OAuth, but when I open the app in the browser and inspect the outgoing XHR requests I don't see the HTTP Authorization header on any of them. There does appear to be a token in the cookies though, something named GCP_IAAP_AUTH_TOKEN.
      Just wondering if this is still considered OAuth or is it some other form of authentication?






      oauth google-cloud-platform







      share|improve this question













      Have an app running in GCP using App Engine and secured by IAP. To the best of my knowledge IAP uses OAuth, but when I open the app in the browser and inspect the outgoing XHR requests I don't see the HTTP Authorization header on any of them. There does appear to be a token in the cookies though, something named GCP_IAAP_AUTH_TOKEN.
      Just wondering if this is still considered OAuth or is it some other form of authentication?






      oauth google-cloud-platform




      oauth google-cloud-platform






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 7 at 18:27









      Dandan

      1808




      1808
























          1 Answer
          1






          active

          oldest

          votes

















          up vote
          0
          down vote



          accepted










          Cloud IAP can use either the cookie GCP_IAAP_AUTH_TOKEN or Authorization: Bearer. Both are derived from OAuth2.




          The credential that Cloud IAP relies on is an OpenID Connect (OIDC)
          token. That token can come from either a cookie GCP_IAAP_AUTH_TOKEN
          or an Authorization: bearer header.




          Authenticating with OpenID Connect






          share|improve this answer





















          • Thanks. Do you know by any chance what scope I should specify for authenticating?
            – Dandan
            Nov 8 at 18:30










          • It depends on what permissions you need. To get started use https://www.googleapis.com/auth/cloud-platform. Reference: developers.google.com/identity/protocols/googlescopes
            – John Hanley
            Nov 8 at 18:34










          • Thanks! One other question, do you know if it'd be possible to use the Google API Client libraries to invoke it programmaticly?
            – Dandan
            Nov 8 at 23:50










          • Here are some how-to guides to get you started cloud.google.com/iap/docs/how-to
            – John Hanley
            Nov 8 at 23:54











          Your Answer






          StackExchange.ifUsing("editor", function () {
          StackExchange.using("externalEditor", function () {
          StackExchange.using("snippets", function () {
          StackExchange.snippets.init();
          });
          });
          }, "code-snippets");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "1"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });














           

          draft saved


          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53195590%2fdoes-oauth-always-use-the-http-authorization-header%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown

























          1 Answer
          1






          active

          oldest

          votes








          1 Answer
          1






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes








          up vote
          0
          down vote



          accepted










          Cloud IAP can use either the cookie GCP_IAAP_AUTH_TOKEN or Authorization: Bearer. Both are derived from OAuth2.




          The credential that Cloud IAP relies on is an OpenID Connect (OIDC)
          token. That token can come from either a cookie GCP_IAAP_AUTH_TOKEN
          or an Authorization: bearer header.




          Authenticating with OpenID Connect






          share|improve this answer





















          • Thanks. Do you know by any chance what scope I should specify for authenticating?
            – Dandan
            Nov 8 at 18:30










          • It depends on what permissions you need. To get started use https://www.googleapis.com/auth/cloud-platform. Reference: developers.google.com/identity/protocols/googlescopes
            – John Hanley
            Nov 8 at 18:34










          • Thanks! One other question, do you know if it'd be possible to use the Google API Client libraries to invoke it programmaticly?
            – Dandan
            Nov 8 at 23:50










          • Here are some how-to guides to get you started cloud.google.com/iap/docs/how-to
            – John Hanley
            Nov 8 at 23:54















          up vote
          0
          down vote



          accepted










          Cloud IAP can use either the cookie GCP_IAAP_AUTH_TOKEN or Authorization: Bearer. Both are derived from OAuth2.




          The credential that Cloud IAP relies on is an OpenID Connect (OIDC)
          token. That token can come from either a cookie GCP_IAAP_AUTH_TOKEN
          or an Authorization: bearer header.




          Authenticating with OpenID Connect






          share|improve this answer





















          • Thanks. Do you know by any chance what scope I should specify for authenticating?
            – Dandan
            Nov 8 at 18:30










          • It depends on what permissions you need. To get started use https://www.googleapis.com/auth/cloud-platform. Reference: developers.google.com/identity/protocols/googlescopes
            – John Hanley
            Nov 8 at 18:34










          • Thanks! One other question, do you know if it'd be possible to use the Google API Client libraries to invoke it programmaticly?
            – Dandan
            Nov 8 at 23:50










          • Here are some how-to guides to get you started cloud.google.com/iap/docs/how-to
            – John Hanley
            Nov 8 at 23:54













          up vote
          0
          down vote



          accepted







          up vote
          0
          down vote



          accepted






          Cloud IAP can use either the cookie GCP_IAAP_AUTH_TOKEN or Authorization: Bearer. Both are derived from OAuth2.




          The credential that Cloud IAP relies on is an OpenID Connect (OIDC)
          token. That token can come from either a cookie GCP_IAAP_AUTH_TOKEN
          or an Authorization: bearer header.




          Authenticating with OpenID Connect






          share|improve this answer












          Cloud IAP can use either the cookie GCP_IAAP_AUTH_TOKEN or Authorization: Bearer. Both are derived from OAuth2.




          The credential that Cloud IAP relies on is an OpenID Connect (OIDC)
          token. That token can come from either a cookie GCP_IAAP_AUTH_TOKEN
          or an Authorization: bearer header.




          Authenticating with OpenID Connect







          share|improve this answer












          share|improve this answer



          share|improve this answer










          answered Nov 7 at 19:14









          John Hanley

          11.1k2527




          11.1k2527












          • Thanks. Do you know by any chance what scope I should specify for authenticating?
            – Dandan
            Nov 8 at 18:30










          • It depends on what permissions you need. To get started use https://www.googleapis.com/auth/cloud-platform. Reference: developers.google.com/identity/protocols/googlescopes
            – John Hanley
            Nov 8 at 18:34










          • Thanks! One other question, do you know if it'd be possible to use the Google API Client libraries to invoke it programmaticly?
            – Dandan
            Nov 8 at 23:50










          • Here are some how-to guides to get you started cloud.google.com/iap/docs/how-to
            – John Hanley
            Nov 8 at 23:54


















          • Thanks. Do you know by any chance what scope I should specify for authenticating?
            – Dandan
            Nov 8 at 18:30










          • It depends on what permissions you need. To get started use https://www.googleapis.com/auth/cloud-platform. Reference: developers.google.com/identity/protocols/googlescopes
            – John Hanley
            Nov 8 at 18:34










          • Thanks! One other question, do you know if it'd be possible to use the Google API Client libraries to invoke it programmaticly?
            – Dandan
            Nov 8 at 23:50










          • Here are some how-to guides to get you started cloud.google.com/iap/docs/how-to
            – John Hanley
            Nov 8 at 23:54
















          Thanks. Do you know by any chance what scope I should specify for authenticating?
          – Dandan
          Nov 8 at 18:30




          Thanks. Do you know by any chance what scope I should specify for authenticating?
          – Dandan
          Nov 8 at 18:30












          It depends on what permissions you need. To get started use https://www.googleapis.com/auth/cloud-platform. Reference: developers.google.com/identity/protocols/googlescopes
          – John Hanley
          Nov 8 at 18:34




          It depends on what permissions you need. To get started use https://www.googleapis.com/auth/cloud-platform. Reference: developers.google.com/identity/protocols/googlescopes
          – John Hanley
          Nov 8 at 18:34












          Thanks! One other question, do you know if it'd be possible to use the Google API Client libraries to invoke it programmaticly?
          – Dandan
          Nov 8 at 23:50




          Thanks! One other question, do you know if it'd be possible to use the Google API Client libraries to invoke it programmaticly?
          – Dandan
          Nov 8 at 23:50












          Here are some how-to guides to get you started cloud.google.com/iap/docs/how-to
          – John Hanley
          Nov 8 at 23:54




          Here are some how-to guides to get you started cloud.google.com/iap/docs/how-to
          – John Hanley
          Nov 8 at 23:54


















           

          draft saved


          draft discarded



















































           


          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53195590%2fdoes-oauth-always-use-the-http-authorization-header%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          -

          這個網誌中的熱門文章

          Xamarin.form Move up view when keyboard appear

          圖片
          .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 0 I'm trying to build a Chat app UI, the idea of the Layout was pretty simple: When the input bar is focused, keyboard show up and "push" up the chat bar, as it's a grid, the ListView will resize to fit the screen: I update the input bar's margin to "push" it up: NSValue result = (NSValue)args.Notification.UserInfo.ObjectForKey(new NSString(UIKeyboard.FrameEndUserInfoKey)); CGSize keyboardSize = result.RectangleFValue.Size; if (Element != null){ Element.Margin = new Thickness(0, 0, 0,keyboardSize.Height); //push the entry up to keyboard height when keyboard is activated } And this is ...
          閱讀完整內容

          Post-Redirect-Get with Spring WebFlux and Thymeleaf

          圖片
          .everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 2 Can someone explain to me how to implement the post-redirect-get pattern in Spring WebFlux and Thymeleaf? What subscribes on the database save method? @GetMapping("/register") public String showRegisterForm(Model model) { model.addAttribute("user", new User()); return "register"; } @PostMapping public String processRegisterForm(@Valid User user, BindingResult bindingResult) { if (bindingResult.hasErrors()) { return "register"; } else { userRepository.save(user); //what subscribes on this? //how to redirect on e.g. "/login"? ...
          閱讀完整內容

          Anylogic : not able to use stopDelay()

          圖片
          -2 I am building a railway station model. I want a train to depart when I click a button. I want to call stopDelay() for that but I am not sure how to do that and from which place. anylogic share | improve this question asked Nov 23 '18 at 10:12 Anupam Singh Anupam Singh 1 Hi Anupam, welcome to SOF. Please check how to ask good questions, see link below. Your question is...
          閱讀完整內容