package main
import (
"fmt"
"net/http"
"time"
"google.golang.org/api/idtoken"
)
func main() {
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
ctx := r.Context()
tok := r.Header.Get("X-Goog-IAP-JWT-Assertion")
if tok == "" {
http.Error(w, "No token found", http.StatusUnauthorized)
return
}
aud := "/projects/149343153723/global/backendServices/4161061106542467993" // TODO: don't hardcode this
payload, err := idtoken.Validate(ctx, tok, aud)
if err != nil {
http.Error(w, "Validate: "+err.Error(), http.StatusForbidden)
return
}
if payload.IssuedAt > time.Now().Unix() {
http.Error(w, "Token issued in the future", http.StatusForbidden)
return
}
if payload.Issuer != "https://cloud.google.com/iap" {
http.Error(w, "Invalid issuer", http.StatusForbidden)
return
}
w.Header().Set("Content-Type", "text/html")
fmt.Fprintln(w, "")
fmt.Fprintln(w, "You are authenticated!
")
fmt.Fprintln(w, "Your email is:", payload.Claims["email"], "
")
fmt.Fprintln(w, `Log out: here
`)
fmt.Fprintln(w, "Failure cases