authlib

import os from flask import Flask, redirect, url_for, session, jsonify from authlib.integrations.flask_client import OAuth app = Flask(__name__) app.secret_key = os.environ.get('FLASK_SECRET_KEY', 'super-secret-key') app.config['GOOGLE_CLIENT_ID'] = os.environ.get('GOOGLE_CLIENT_ID', '') app.config['GOOGLE_CLIENT_SECRET'] = os.environ.get('GOOGLE_CLIENT_SECRET', '') app.config['GOOGLE_AUTHORIZE_URL'] = 'https://accounts.google.com/o/oauth2/auth' app.config['GOOGLE_ACCESS_TOKEN_URL'] = 'https://oauth2.googleapis.com/token' app.config['GOOGLE_USERINFO_ENDPOINT'] = 'https://openidconnect.googleapis.com/v1/userinfo' app.config['GOOGLE_JWKS_URI'] = 'https://www.googleapis.com/oauth2/v3/certs' # Configure a dummy URL for local testing # In a real app, ensure this is HTTPS and a valid redirect URI configured with your OAuth provider app.config['GOOGLE_REDIRECT_URI'] = os.environ.get('GOOGLE_REDIRECT_URI', 'http://127.0.0.1:5000/authorize') oauth = OAuth(app) oauth.register( 'google', client_id=app.config['GOOGLE_CLIENT_ID'], client_secret=app.config['GOOGLE_CLIENT_SECRET'], authorize_url=app.config['GOOGLE_AUTHORIZE_URL'], access_token_url=app.config['GOOGLE_ACCESS_TOKEN_URL'], userinfo_endpoint=app.config['GOOGLE_USERINFO_ENDPOINT'], jwks_uri=app.config['GOOGLE_JWKS_URI'], # Required for OIDC id_token validation client_kwargs={'scope': 'openid email profile'} ) @app.route('/') def index(): user = session.get('user') if user: return f'Hello, {user.get("name", "User")}! <a href="/logout">Logout</a>' return '<a href="/login">Login with Google</a>' @app.route('/login') def login(): redirect_uri = url_for('authorize', _external=True) return oauth.google.authorize_redirect(redirect_uri) @app.route('/authorize') def authorize(): try: token = oauth.google.authorize_access_token() userinfo = oauth.google.parse_id_token(token) session['user'] = userinfo return redirect('/') except Exception as e: return f'Authorization failed: {e}', 400 @app.route('/logout') def logout(): session.pop('user', None) return redirect('/') if __name__ == '__main__': # For local development, allow insecure transport # NEVER use in production without proper HTTPS setup os.environ['AUTHLIB_INSECURE_TRANSPORT'] = '1' print("To run, set environment variables like:") print("export FLASK_SECRET_KEY='your-flask-secret-key'") print("export GOOGLE_CLIENT_ID='YOUR_GOOGLE_CLIENT_ID'") print("export GOOGLE_CLIENT_SECRET='YOUR_GOOGLE_CLIENT_SECRET'") print("Then: flask --app YOUR_APP_FILE.py run") app.run(debug=True)